26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 14b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T58a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 6698fdcb7f1a… — Score 100/100 — Sample cac4d4364d20…","description":"Malicious verdict for sandbox report 6698fdcb7f1a…. Threat score 100/100. 0 malicious and 5 suspicious behavioral indicators across 114 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775/6698fdcb7f1a3ff8f5037c47","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775"],"about":{"@type":"SoftwareApplication","name":"Advisory23-UCDMS04-11-01.pdf.lnk","applicationCategory":"MS Windows shortcut, Item id list present, Points to a file or directory, Has command line arguments, Icon number=0, Archive, ctime=Sun Sep 3 12:54:49 2023, mtime=Fri Dec 29 07:40:13 2023, atime=Sun Sep 3 12:54:49 2023, length=486400, window=hide","identifier":"cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":0,"suspicious":5,"totalSignatures":114},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAE4klEQVR4Xu2VW0wcVRzG14cKpt3WmGhrK21NSVuEqDFeUkPii+iridEHJcYm9UENqVITLE0bW91KishWpQRQI2pSSooUSxtZSCvXvXCT23JZ2F2WvcJeuN/h8/wPzuzs7C4XY9/8kl9mzpyZ//ed/9mdUSj+1yblcrngdDrhcDg4drtdhMY0R9B9brebn1utVsjrhOnGwSdxLxgeHobRaOTHtLS06EFKDiTh9xdeDqHx/VMc6bjmtbfD7osG1bRYLNBqtSBRJ6KGKI57Alf3J4UgKGDsQ1nSMXFsvl4RMk+SP0tQTbPZLAYgUSfk3lyFjx3FL/sTQyDR0aa5g47cK3ysefNdTNsdaErPFOejQTWlHRA0MDAQHuKbvYfxI0sshVR6LAU+1gH9+Sw+puvtuXkcqeTPElSTAuh0upB7SfS7CAmQ/Wg8ClhiKYK6fvhZHNPRqTXg7sen+fjmG+9w5M8SVJP2vbW1FaWlpVCr1cjLy4NGo8HExAR6e3uDIVR7DiFv35EQSPIxqeP74ojzcqgm7Tm1vLKyEkVFRTyESqVCbm4u/6uKAc7ufhxq1rL1uP56KvKPPht2PRpUkwJ4PB6+FX19fejs7IRer0ddXV3oNmQ8fAD3ApvNBr/fj0AgwBkfH4fP5+MvLXpRiQFiY2OhVCrXJSYmBgaDgUOrEM4FmpubUXffNtQfToA2/RP09PTwN6HUnPZ+cnKSMzU1Ff5v2EjU0mjQatsV29D30SmYctb22Ov1cuNI5tPT01sPQO2LBrW6W/kQehOfhuvmrRDjSOYzMzNbD0Am0aA2d734EvSsC576hojGUvN/FUDYTznCavszMlGnuD+qsWA+OzvLkdffUIKRHGG1xowz0ChiMJRfGNFYMJ+bm+PI628owUiKsFLiD+UjqI6LRxVjnP3V5MZS8/n5+WAAj2cS7rEJuIjRcTgZDk+AY3f7MeLyw+byYdjJcHjh9vjDWtz+6VmUK3fD2aTDb+zY+NbxqMbEwsJCMACZbkVDtrGQ9gbYaq8p96Dl9Gfc1KHV4yob30h6DqbSMo7+zAW0ZavhMrRw88XFxWAAWulWZLJ6xNYSemZcEncEDp0BuszzqEhOQYFiOyefcUWxAz/FJaAq9QT7UibAUn0XS0tLwQDUXqkmFlaQUu7C89ecnGd+teOD6lFxvt/sFltrZ6Z5zIAoS34FjZkXYK6qwaTbw1ttqb6D26nvoYB9orMVSqh37oOjpQ3Ly8vBAFa2r3Kd0wVwstaLQ0XDeFBtRmKhVZwzDjox7nKj5sN0fM2KliS/Ku6tsL8C1GqCVkxMe33cfGVlJRjAPDImsQ4qS+vHrpxB7M0dRPzlIfF694AD37FW5rDVEKP9poimUmMyFYyJ1dXVYADTsEdiu6Yvm/zYccmEiw0+HC9z4OClAXGus28E5xQ7Oc1FxSGGUtNoxgRJDNBvcYvFSRcbfdieNQBV3drWnLzpwlOXB8X5dqMNGYpdqP3q2zBDqWk0Y0FiAOOQU7yoqvfiAVU/vqgN/V0E5lbE89Zu64aGUlO5sSAxQLfJIV48UeHC539G/k0IMnRaIhpuxlQqMUBn/4h8bl3p/jKHmW3WVCoxQHuvTT63rpraBrf+IVlPzaylLV1WNBPsnFqs7zDzlWrbh9BEMNPGfyi/3fCfBvgb++m6r1cC6fQAAAAASUVORK5CYII=28:T539,"powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694080442 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694088016 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694910956 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694918625 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-696609327 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-696616837 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-697077231 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-697108330 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-698720507 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-699125507 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-699133079 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-703349469 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-703356981 [PID: 1412]29:T1252,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e04ac6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7048c6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e044c6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50f5c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0f5c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60f1c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0efc7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0f4c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "3081c9baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "4082cbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d07ccbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "107fcbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "208c9aa0f2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b08c9aa0f2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2077c9baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e08c9aa0f2010000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7017d1baf2010000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b010d1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8013d1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "700ed1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "400ed1baf2010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2019d1baf2010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c018d1baf2010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"}2a:T2aa6,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e02fc6baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6027c6baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2079c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2077c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a087c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207ac7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207cc7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2089c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207bc7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70eccbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70e6cbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0eecbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50fbcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d007cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0fbcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50f7cdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5001cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5009cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0edcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5006cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5006cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50edcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0f9cdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0fbcdbaf2010000"}2b:T981,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "3068c5baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f095c7baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70a3c7baf2010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "909bc7baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70becebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10c4cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b2cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "d0b8cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f0b0cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70b5cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10bbcebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0c9cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "30b3cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "90b6cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70c7cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "90c8cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "50b4cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"}2c:T1b3c,"powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938553bfc7f000080000000000000000000000000000000e0b58ea0f20100001033963dfc7f000000000000000000000000d83cfc7f0000f0d06790950000001041523bfc7f000080d58da0f2010000b0d0679095000000000000000000000000000000000000000100000000000000b840523bfc7f0000000000000000000001000000000000000000d83cfc7f00003b4de43afc7f0000000000000000000060d56790950000000000000000000000d02aea3cfc7f000010b3503dfc7f0000e8f8513bfc7f000010b3503dfc7f0000d02aea3cfc7f00000d000000fc7f00000d00000000000000a0f6403dfc7f0000f587e53cfc7f0000d02aea3c (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000010778fa0f20100009a248fa0f2010000b0238fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f0000000000000000000010778fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000056248fa0f20100006c248fa0f201000056248fa0f20100009a248fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056248fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a0788fa0f2010000ac258fa0f2010000c0248fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000a0788fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0f20100007e258fa0f201000066258fa0f2010000ac258fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a07d8fa0f201000068e78fa0f201000080e68fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000a07d8fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000026e78fa0f20100003ae78fa0f201000026e78fa0f201000068e78fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026e78fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000601c8ea0f20100004c308fa0f2010000602f8fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000601c8ea0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000006308fa0f20100001e308fa0f201000006308fa0f20100004c308fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006308fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000907e8fa0f2010000aa258fa0f2010000c0248fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000907e8fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0f20100007c258fa0f201000066258fa0f2010000aa258fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000e08d90a0f20100008c348fa0f2010000a0338fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000e08d90a0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0f20100005e348fa0f201000046348fa0f20100008c348fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f09190a0f20100008c348fa0f2010000a0338fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000f09190a0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0f20100005e348fa0f201000046348fa0f20100008c348fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412)2d:T963,"powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694703993 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694730839 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694741311 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-697322402 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001412-00000C15-697599146 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001412-00000C15-697676397 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001412-00000C15-699009519 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-699326513 "powershell.exe" queries volume information of "C:\share" at 00000000-00001412-00000C15-699328037 "powershell.exe" queries volume information of "C:\share" at 00000000-00001412-00000C15-699387870 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700133317 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700293340 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700386098 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-7004349412e:T2e47,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001412)2f:T9319,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001412)30:Tb59,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]31:T28d5,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 3ae00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 3ae00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 3ae00000 "powershell.exe" loaded module "KERNEL32" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 6e30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 38360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 38d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 21020000 "powershell.exe" loaded module "KERNEL32.DLL" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 34a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 39cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 3b620000 "powershell.exe" loaded module "RPCRT4.DLL" at base 3cab0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 2c5e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\TASKFLOWDATAENGINE.DLL" at base 1e3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 265e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 3ca00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 8180000 "powershell.exe" loaded module "SHLWAPI.DLL" at base a2390000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 39d80000 "powershell.exe" loaded module "VERSION.DLL" at base 30250000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base f9680000 "powershell.exe" loaded module "USER32.DLL" at base 3bf40000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 8220000 "powershell.exe" loaded module "NTDLL" at base 3d910000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base f80c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 3bb70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 3bd10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base f74a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base f6a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 3ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base f4990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 3b7c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 3d910000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 3b750000 "powershell.exe" loaded module "SHELL32.DLL" at base 3cd80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 2ccb0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 3b6a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 3b390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 30250000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 2cc10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MW7WSIXR.DLL" at base 6ea0000 "powershell.exe" loaded module "WLDP.DLL" at base 3a520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 3f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 1610000 "powershell.exe" loaded module "CRYPT32.DLL" at base 3b390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 30fc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base ba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 76e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 57c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 21620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base f40e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base f3750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base f33e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 3a610000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base f32b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 22a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 1530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 2fd30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 39fd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base f3180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 3ca00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base f2f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base f2220000 "powershell.exe" loaded module "KERNELBASE" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 26300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 38bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 2b460000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "VIRTDISK.DLL" at base bcf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 33fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 381c000032:T6cf,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "powershell.exe" touched "Adobe Acrobat Document" (Path: "HKCU\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\PROGID") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS")33:T52e,Observed system executable string:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: Advisory23-UCDMS04-11-01.pdf.lnk] Observed system executable string:"/C:\ADVISO~1.LNKC:\Advisory23-UCDMS04-11-01.pdf.lnkdtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV/C:\WindowsSystem32WindowsPowerShellv1.0T@{ powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV/C:\WindowsSystem32WindowsPowerShellv1.0T@{ powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV" [Source: DH7716QWUQ6F416J2N8H.temp] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00001412-00000BC0-693199346] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" [Source: 00000000-00001412-00000BC0-700727645] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00001412-00000C28-2091103952] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" %TEMP%\ChromeConnection" [Source: 00000000-00001412-00000C41-16517684126]34:T1328,Observed system executable string:"

                                                                                                                                                        ;\" (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","description_v2":["file/memory contains long string with (Indicator: \"System.Security.Cryptography\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","file/memory contains long string with (Indicator: \"base64\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","file/memory contains long string with (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","Found string \"aEs>;\" (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"System.Security.Cryptography\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"base64\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aEs>;\" (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qs4brnfz.b53.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5tlt2ead.5tb.psm1\" with delete access","description_v2":["\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp\" with delete access","\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qs4brnfz.b53.ps1\" with delete access","\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5tlt2ead.5tb.psm1\" with delete access"],"description_v3":[{"type":"text","value":"\"powershell.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" opened \"%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5tlt2ead.5tb.psm1\" with delete access"}],"origin":"API Call","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-111","type":6,"relevance":3,"name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001412)","description_v2":["\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001412)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001412)"}],"origin":"API Call","attck_id":"T1134","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-693199346\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-700725176\")\n Found string \"\\Device\\HarddiskVolume3\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC1-703171992\")","description_v2":["Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-693199346\")","Found string \"\\Device\\HarddiskVolume3\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-700725176\")","Found string \"\\Device\\HarddiskVolume3\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC1-703171992\")"],"description_v3":[{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-693199346\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-700725176\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC1-703171992\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"E92ECC8441D9DA0100000000000000000000000002000000\")","description_v2":["\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"E92ECC8441D9DA0100000000000000000000000002000000\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"E92ECC8441D9DA0100000000000000000000000002000000\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-19","type":3,"relevance":10,"name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","description_v2":["\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","description_v2":["\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$3f","description_v2":["\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSBUILD.EXE\"; Value: \"\")","\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")","\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"\"), \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\"), \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSBUILD.EXE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"\"), \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\"), \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-47","type":3,"relevance":7,"name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","description_v2":["\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")","\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")"}],"origin":"Registry Access","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-136","type":3,"relevance":3,"name":"Writes registry keys","description":"$40","description_v2":["\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"01000000\")","\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"01000000\")","\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"00000000\")","$41"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"01000000\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"00000000\")"},{"type":"linebreak"},{"type":"text","value":"$42"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"binary-37","type":8,"relevance":3,"name":"Drops files inside appdata directory","description":"Dropped file: \"UserCache.bin\"  - Location: [%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin]- [targetUID: 00000000-00007104]\n Dropped file: \"Annssi.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat]- [targetUID: 00000000-00007104]\n Dropped file: \"Annss.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat]- [targetUID: 00000000-00007104]\n Dropped file: \"DH7716QWUQ6F416J2N8H.temp\"  - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp]- [targetUID: 00000000-00001412]\n Dropped file: \"StartupProfileData-NonInteractive\"  - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001412]\n Dropped file: \"Annssk.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat]- [targetUID: 00000000-00007104]","description_v2":["Dropped file: \"UserCache.bin\"  - Location: [%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin]- [targetUID: 00000000-00007104]","Dropped file: \"Annssi.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat]- [targetUID: 00000000-00007104]","Dropped file: \"Annss.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat]- [targetUID: 00000000-00007104]","Dropped file: \"DH7716QWUQ6F416J2N8H.temp\"  - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp]- [targetUID: 00000000-00001412]","Dropped file: \"StartupProfileData-NonInteractive\"  - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001412]","Dropped file: \"Annssk.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat]- [targetUID: 00000000-00007104]"],"description_v3":[{"type":"text","value":"Dropped file: \"UserCache.bin\"  - Location: [%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin]- [targetUID: 00000000-00007104]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"Annssi.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat]- [targetUID: 00000000-00007104]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"Annss.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat]- [targetUID: 00000000-00007104]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"DH7716QWUQ6F416J2N8H.temp\"  - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp]- [targetUID: 00000000-00001412]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"StartupProfileData-NonInteractive\"  - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001412]"},{"type":"linebreak"},{"type":"text","value":"Dropped file: \"Annssk.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat]- [targetUID: 00000000-00007104]"}],"origin":"Binary File","attck_id":"T1036","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"binary-35","type":8,"relevance":5,"name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_qs4brnfz.b53.ps1\"  - Location: [%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1]- [targetUID: 00000000-00001412]","description_v2":["Dropped file: \"__PSScriptPolicyTest_qs4brnfz.b53.ps1\"  - Location: [%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1]- [targetUID: 00000000-00001412]"],"description_v3":[{"type":"text","value":"Dropped file: \"__PSScriptPolicyTest_qs4brnfz.b53.ps1\"  - Location: [%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1]- [targetUID: 00000000-00001412]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-129","type":6,"relevance":10,"name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" \"%TEMP%\\Advisory23-UCDMS04-11-01.pdf\"\" - (UID: 00000000-00001412)","description_v2":["\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" \"%TEMP%\\Advisory23-UCDMS04-11-01.pdf\"\" - (UID: 00000000-00001412)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" \"%TEMP%\\Advisory23-UCDMS04-11-01.pdf\"\" - (UID: 00000000-00001412)"}],"origin":"API Call","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"target-300","type":9,"relevance":5,"name":"Detected MSBuild process execution","description":"Process \"MSBuild.exe\" with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)","description_v2":["Process \"MSBuild.exe\" with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)"],"description_v3":[{"type":"text","value":"Process \"MSBuild.exe\" with commandline \"%TEMP%\\\\ChromeConnection\""},{"type":"process","process_uid":"00000000-00002796","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1127.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1127/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"target-411","type":9,"relevance":3,"name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" launched with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)","description_v2":["Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" launched with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)"],"description_v3":[{"type":"text","value":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" launched with commandline \"%TEMP%\\\\ChromeConnection\""},{"type":"process","process_uid":"00000000-00002796","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-87","type":3,"relevance":7,"name":"Contains ability to detect virtual environment","description":"\"AcroRd32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")","description_v2":["\"AcroRd32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")"],"description_v3":[{"type":"text","value":"\"AcroRd32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")"}],"origin":"Registry Access","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)\n \"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)","description_v2":["\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)","\"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)","\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)","\"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)","\"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)"}],"origin":"API Call","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 11","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 22621)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"11.2.0","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[],"icon":"$43","visualization":"$44","classification":["100.0% (.LNK) Windows Shortcut"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"ITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ITJMWyB7VzE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IiVURU1QJVxBZHZpc29yeTIzLVVDRE1TMDQtMTEtMDEucGRmIg==","type":"Ansi","source":"Process Commandline","process":"AcroRd32.exe","filename":"AcroRd32.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVXSU5ESVIlXE1pY3Jvc29mdC5ORVRcRnJhbWV3b3JrNjRcdjQuMC4zMDMxOVxNU0J1aWxkLmV4ZSIgJVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IjZwLkFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Ij8uMGNPKyF5Uw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IiVQUk9HUkFNRklMRVMlXCh4ODYpXEFkb2JlXFJlYWRlciAxMS4wXFJlYWRlclxBY3JvUmQzMi5leGUiICIlVEVNUCVcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZiI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IlVePUU2TypGVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IyBQb3dlclNoZWxsIHRlc3QgZmlsZSB0byBkZXRlcm1pbmUgQXBwTG9ja2VyIGxvY2tkb3duIG1vZGU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"__PSScriptPolicyTest_5tlt2ead.5tb.psm1","compromised":null,"detection_total":null,"total":null},{"value":"Izk/SlpiPkY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JGc7d1d4fj94cGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JGdsb2JhbDo/","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"JGk9JGVudjp0bXA7JGU9IkFkdmlzb3J5MjMtVUNETVMwNC0xMS0wMS5wZGYubG5rIjskaD1nY2kgJGkgLXIgLWVhIDB8P3skXy5OYW1lIC1saWtlICRlIC1hbmQgJF8uTGVuZ3RoIC1lcSAxODk4OTEyfXxzb3J0IExhc3RXcml0ZVRpbWUgLWRlc2M7aWYoJGguQ291bnQgLWd0IDApeyRlPSRoWzBdLkZ1bGxOYW1lO307JHE9W1N5c3RlbS5JTy5GaWxlXTskbj0kcTo6UmVhZEFMbEJ5dGVzKCRlKTskeT0kaSsiXENocm9tZUNvbm5lY3Rpb24iOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzI3NzIuLjk3MjExXSk7YzpcdypcKnRcKjRcdjQqXCpkLiplICR5OyR5PSRpKyJcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZiI7JHE6OldyaXRlQWxsQnl0ZXMoJHksJG5bOTcyMTEuLjE4OTg5MTJdKTtpZih0ZXN0LXBhdGggJHkpeyYkeTt9Ow==","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"JGk9JGVudjp0bXA7JGU9XCJBZHZpc29yeTIzLVVDRE1TMDQtMTEtMDEucGRmLmxua1wiOyRoPSJnY2kgJGkgLXIgLWVhIDB8P3skXy5OYW1lIC1saWtlICRlIC1hbmQgJF8uTGVuZ3RoIC1lcSAxODk4OTEyfXxzb3J0IExhc3RXcml0ZVRpbWUgLWRlc2MiO2lmKCRoLkNvdW50IC1ndCAwKXskZT0kaFswXS5GdWxsTmFtZTt9OyRxPVtTeXN0ZW0uSU8uRmlsZV07JG49JHE6OlJlYWRBTGxCeXRlcygkZSk7JHk9JGkrXCJcQ2hyb21lQ29ubmVjdGlvblwiOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzI3NzIuLjk3MjExXSk7YzpcdypcKnRcKjRcdjQqXCpkLiplICIkeSI7JHk9JGkrXCJcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZlwiOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzk3MjExLi4xODk4OTEyXSk7aWYodGVzdC1wYXRoICR5KXsmJHk7fTs=","type":"Ansi","source":"Process Commandline","process":"powershell.exe","filename":"powershell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JHRhQTg9KkpibQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTVBDTElFTlQuRExM","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTXNNcExpY3MuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5BcHBsaWNhdGlvbkNvbXBhbnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5GcmllbmRseUFwcE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQU1JlYWRMaW5lXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Ansi","source":"Process Commandline","process":"MSBuild.exe","filename":"MSBuild.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcKnQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo0","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcZjQ4ODlmYTAzMmY4MDIzZmUyODBhNTQ3MDBkNmQzYTVcTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcNDY4ZmE1YWU4NDk5MWFhZjRkOTBlY2VlODc4OGYwMjRcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcNDk3NTBlYTAzODI3M2Y3NTMyMWU0NzllZjE1MjVkMWVcTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcOTQ5NGVkYTBjOWFmNTAzY2I2MWZlNDUwYjViYTljMWFcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcODZhZjJmNGYyNzQ1NzM4ODM3Yzk1ZjI0NDcyYzMyY2FcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUg=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcM2I5MDAzZTRmMjdkOTJlNDA2NjhmMGVmYWQxMWUwMjJcbXNjb3JsaWIubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcYjRjMzQ1MjNjNTgyMTQ2ZGVhM2NhMzg5ZTM0ODcxNDVcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cMmEyNWI1OTg3MmE3MmRhOWI1NWY5NTJhYjFiMGJjOGJcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcOTkwNTAxZTYxOTk4MTk4MDZmMDFjOGVjYWM4OGJhYWNcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcYmYzZDJlNjA0MmQ5NDNlMGZlYzljY2MwZDcyYzhmM2JcU3lzdGVtLkRhdGEubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcMmQxZmYyYWIzMTMxZGU2YTUwN2YyMmNjYzUzYjI3M2FcU3lzdGVtLkRpcmVjdG9yeVNlcnZpY2VzLm5pLmQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcZWE4OTNkN2UzMzZhMTk2YzkyN2MzZjEyNTFhMWQxYTlcU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbi4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcNjI4N2UwOTAxNWEzMTFhNjRjNGZlMDMwNDgxOGY4YzNcU3lzdGVtLk1hbmFnZW1lbnQubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk51bWVyaWNzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1xkZDBlZDc5NWQ3MjM0YTJhZTQzMTRkZTA1Mjg2NzE2MVxTeXN0ZW0uVHJhbnNhY3Rpb25zLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFxmMDA3OGM4YzA1YjMxNjMzZTU5NjZjNTYyOWU2NTYwMlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGNlMGZkNGY1YjUwYmFhMTdlN2I4MGU0ZWU4NzRhZDExXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcQm9vdFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcQm9vdFwqNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFwqNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNvbWJhc2UuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG9sZWF1dDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNlY3VyMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNoZWxsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLkRhdGFcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XFN5c3RlbS5EYXRhLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1x2NC4wXzQuMC4wLjBfX2I3N2E1YzU2MTkzNGUwODlcU3lzdGVtLlRyYW5zYWN0aW9ucy5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVxzaGx3YXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVx3aW50cnVzdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFxcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCpkLipl","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1yb3BhcmFtZXRlcml6ZWRpaWQtbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1zdHJpbmctbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNsci5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNscmppdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XENSWVBUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuLVVTXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE1TQnVpbGQuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWUuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWVpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG9sZTMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE9MRUFVVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XFZFUlNJT04uZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU29ydC1PYmplY3QuKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZW4tVVNcdHpyZXMuZGxsLm11aQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJca2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcU29ydC1PYmplY3QuKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLlV0aWxpdHlcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2luZG93c3Bvd2Vyc2hlbGxcdjEuMFxwb3dlcnNoZWxsX2lzZS5leGU=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Jk8+XzVLYXUs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Jzk9ODI8LjM0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J0paQj86MUA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J09KWik7cUA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J3paaFw2e2I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KDcpLDAxNDQ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KEB9TVR1LVtP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KS5HZXRUeXBlKCJTeXN0ZW1SdW50aW1lLlByb2dyYW0iKS5HZXRNZXRob2QoIk1haW4iKS5JbnZva2UobnVsbCxuZXcgb2JqZWN0W117bmV3IHN0cmluZ1tdeyJZbGRiVVZOUVYxQmEiLCJaZzRTRWhaY1NVa0FEd29ERlVnV0RnOEtCQU1JQWdNRkRVZ0ZDUXRKIiwiTVZsRlJVRkNDeDRlVjFoZFZFSWZRVmxZWFZOVVgxVlVVbG9mVWw1Y0hnPT0iLCI0MSIsIjUyIiwiNTEzMyJ9fSk7fWNhdGNoe30gcmV0dXJuIHRydWU7ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L0NvZGU+ICAgICAgICAgICAgICAgIDwvVGFzaz4gICAgICAgICAgICA8L1VzaW5nVGFzaz4gICAgICAgIDwvUHJvamVjdD4lUERGLTEuNzEgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0xIC9XaWR0aCAyNDc5IC9IZWlnaHQgMzQ5MiAvTGVuZ3RoIDU4MDI4Ni9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KUVudmlyb25tZW50LkV4aXQoLTEpO1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Kjsob10sJXE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KkZ9K0UmaWg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KmkkSGNpJHVEUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KkowZGByTXs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KlZlRSxIOSQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LCAwKTt2YXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LCFWYkkgdSY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LTBnTyZ4RjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LT5tX0dbTSY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LWlnIyxQRk9APw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LXQ9T19tN10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LklzQmFja2dyb3VuZD10cnVlOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Lkxlbmd0aDsgaSsrKXs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LlN0YXJ0KCk7Ynl0ZVtd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L0M6XEFEVklTT34xLkxOS0M6XEFkdmlzb3J5MjMtVUNETVMwNC0xMS0wMS5wZGYubG5rZHRsNGRyYzhqN3p4aXNiMVNQUzFTUFN8TylEdjwgLXVWLyVXSU5ESVIlXHlzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vi9DOlxXaW5kb3dzU3lzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"DH7716QWUQ6F416J2N8H.temp","compromised":null,"detection_total":null,"total":null},{"value":"$45","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L3pAeyc1SXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L34oeEF8Qyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MFt4c09WRGdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MGJjYTQ3ODQtODI1Ny01MWEwLWQ5ZWMtMjRmZTFmZTRjOTBk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTIzNDU2Nzg5MC4xMjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MTg2MDhlNjItYTYyOC00OWQ5LThjMDItNTU5NzJlMDk3ZDI0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$46","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MjMtVUNETVMwNC0xMS0wMQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"$47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MmRVfXY8NG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MyopZiFUckk4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$48","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$4a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$4b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MzcyMGRkYTctY2FlYS00YWYzLWExMzgtMzc1YWFmYzNmMWQ2","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzgyYjVlMjQtMTgxZS00MTdmLWE4ZDYtMjE1NWY3NDllNzI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzlkZGNiOGQtZWY4Mi01Yzg0LTg5Y2EtMDk1ODBiZjBhOTQ3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$4c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$4d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$4e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"M2xfYnJ8RSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$4f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"M1VebSo4WW5mRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NCttU3lzdGVtLk51bWVyaWNzTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QwODN+dkdTeXN0ZW1TeXN0ZW0uQ29yZVN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb25MTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHJ1Y3R1cmVTeXN0ZW0uTWFuYWdlbWVudFN5c3RlbS5EaXJlY3RvcnlTZXJ2aWNlczRTeXN0ZW0uWG1sU3lzdGVtLkRhdGFTeXN0ZW0uQ29uZmlndXJhdGlvbkgmJ0h4LU1pY3Jvc29mdC5Qb3dlclNoZWxsLlNlY3VyaXR5U3lzdGVtLlRyYW5zYWN0aW9uc01pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbW1hbmRzLk1hbmFnZW1lbnREU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbFBNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5","type":"Ansi","source":"File String Dumps","process":null,"filename":"StartupProfileData-NonInteractive","compromised":null,"detection_total":null,"total":null},{"value":"NDE4QTA3M0FBM0JDMzQ3NQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDg4OTVDMjQwODQ4ODk3NDI0MTA1NzQ4ODNFQzIwOEIwNUUzNzQ4NTAwMzNEQjQ4OEJGOTg1QzAwRjg1OTUwMDAwMDAzODFEQThERDg0MDAwRjg1ODkwMDAwMDBGRjE1QzRCNjY3MDA0ODhCMEQyNUUwODQwMDhCRjA0ODg1Qzk3NDFDNDg4QjAxNEM4QjA3NDg4QjU3MDg0ODhCODBCMDAyMDAwMEZGMTU1N0JGNjcwMDgzRjhGRjc0NTQ0ODhCMEY4MTM5MDYwMDAxNDA3NDRFODEzOTg4MTM2RDQwNzQ0NjQ4OEI1NzA4RThDMkZFRkZGRkU4MzE4QzBDMDA0ODg1QzA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$51","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NGU3YWRkMWEtNjk0NS00MzVhLTgyYjYtNjEyNjg4YmE5ZjU3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$52","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NEktZGVxLHlc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWViNjBiMzYtNjIwNi01NTM4LWU2MGEtMGE3YWY4YTFlNTlk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjBpNV1mbT5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzBaX1sgSSN5MDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$53","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OCFEOVxVUXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OGNjY2EyN2QtZjFkOC00ZGRhLWI1ZGQtMzM5YWVlOTM3NzMx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OSFGcDBpcjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OnwzRTxiSGRZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"O2chUlIoWV1H","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PDMhR19QaCU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PDNeLlx9TX06MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PEN7O3hTQlksYiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$54","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PSdTO3wlck5OLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PSsxPiJoOHY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PS9fPy53cik=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PUJFYzRSeWs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$55","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PWZhbHNlO3Zhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PUdldENvbnNvbGVXaW5kb3coKTtTaG93V2luZG93KA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PW5ldyBNdXRleCh0cnVlLCJ7MjNCNEQ1NzYtMTU0Ny00MzlDLUIxMDctOUFCNUUyOEU5NDlCfSIsb3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PW5ldyBUaHJlYWQoKCk9PntUaHJlYWQuU2xlZXAoMTgwKjEwMDApO1Byb2Nlc3MuU3RhcnQobmV3IFByb2Nlc3NTdGFydEluZm97QXJndW1lbnRzPUVuY29kaW5nLkFTQ0lJLkdldFN0cmluZyhDb252ZXJ0LkZyb21CYXNlNjRTdHJpbmcoIkwyTnlaV0YwWlNBdmMyTWdUVWxPVlZSRklDOXRieUF6TUNBdmMzUWdNRGM2TURBNk1EQWdMM1J1SUNKRGFISnZiV1ZEYjI1dVpXTjBhVzl1SWlBdmRISWdJbU50WkNBdll5QnpkR0Z5ZENBdmJXbHVJQ1YzYVc1a2FYSWxYRTFwWTNKdmMyOW1kQzVPUlZSY1JuSmhiV1YzYjNKck5qUmNkalF1TUM0ek1ETXhPVnhOVTBKMWFXeGtJQ1YwWlcxd0pWeERhSEp2YldWRGIyNXVaV04wYVc5dUlpQXZaZz09IikpLENyZWF0ZU5vV2luZG93PXRydWUsRXJyb3JEaWFsb2c9ZmFsc2UsRmlsZU5hbWU9InNjaHRhc2tzIixXaW5kb3dTdHlsZT1Qcm9jZXNzV2luZG93U3R5bGUuSGlkZGVuLH0pO30pOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PXBpQG5yRjti","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PX1oIyVAcjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PiZ4d1QsVWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PipdRlh0KyxN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PntsVFhlIkZYWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PzV9NV8yfEU3Xg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P3FPUipjTUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P1pCeCBycU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P1piWkpaQ25OenE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxTZXNzRW52LmRsbCwtMTAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXFN5c1dPVzY0XEFwcHhQYWNrYWdpbmcuZGxsLC0xMDAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QEk5PTNRbUo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QHcucEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Wy4nXzZiRmNc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldID0gKGJ5dGUpKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldIF4gMTIwKTt9QXNzZW1ibHkuTG9hZCg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W3ZXPnFDIVw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XFwuXHBpcGVcUFNIb3N0LjEzMzY1ODAxMzE5NTQ5MTA0Mi4xNDEyLkRlZmF1bHRBcHBEb21haW4ucG93ZXJzaGVsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcUHJvZ3JhbSBGaWxlcyAoeDg2KVxBZG9iZVxSZWFkZXIgMTEuMFxSZWFkZXJcQWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29yazY0XHY0LjAuMzAzMTlcTVNCdWlsZC5leGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XGlWV1NIflt7eCMuRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XFBJUEVcc3J2c3Zj","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XzU0Wl06WUEs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Xz58Uzt+MmlSfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"X19QU0xvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X0NvckRsbE1haW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X0NvckRsbE1haW5fUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X3JHektUK1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YEt7aFdscUYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YSFmPzRMezV8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YSs6ez1KWCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$56","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YTQwYjQ1NWMtMjUzYy00MzExLWFjNmQtNmU2NjdlZGNjZWZj","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNyb1JkMzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBY3RDdHg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBdFN0b3JhZ2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkQWNjZXNzQWxsb3dlZEFjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGxsRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVmQWN0Q3R4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVtb3ZlQXBwcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkU0lEVG9Cb3VuZGFyeURlc2NyaXB0b3I=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YURlZmF1bHRTZWxlY3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2VzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgUmVhZGVy","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0ZWQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWSVNPUlk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"YUVzPjs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGaWxlQ0xTSURKdW5jdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUNsb3NlU2Vzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaU9wZW5TZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVNjYW5CdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVVuaW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QU5UU1RJQ1Mu","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXF1aXJrcy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXJvcGFyYW1ldGVyaXplZGlpZC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXN0cmluZy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwY29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwSURGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25CYXNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0Q2xyQ29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlc18zNjM1NDQ4OQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVVUSE9SSVRZ","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXR5","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NvbmZpZ1VSTA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b2RpYWxETEw=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXZIPmJHcU0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QXZvaWRLbm93bkZvbGRlckNhY2hpbmc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$57","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$58","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YiA7Rls9KUAn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YicmNCR3KilEMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YjE2NDI1OTctMjg1ZS01NjBhLTdmNjAtN2UwMmY1ZGEyMmMw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$59","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qj8vZCo2enFO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkNvbGxhYl9PZmZsaW5lRG9jcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkNvbGxhYl9Xb3JrZmxvd3M=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVPU1RydXN0ZWRTaXRlcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVUcnVzdGVkRm9sZGVycw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVUcnVzdGVkU2l0ZXM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc3BsYXlBYm91dERpYWxvZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc3BsYXllZFNwbGFzaA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRvY3VtZW50c0luVGFza2Jhcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuZm9yY2VSZWFkUmVzdHJpY3Rpb25z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuaGFuY2VkU2VjdXJpdHlJbkJyb3dzZXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuaGFuY2VkU2VjdXJpdHlTdGFuZGFsb25l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmV0YVBsYXRmb3Jt","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkZvcm1zX0FkaG9jV29ya2Zsb3dCYWNrdXA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ymhhc1VucmVhZA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkpTQ2FjaGVfR2xvYkRhdGE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkpTQ2FjaGVfR2xvYlNldHRpbmdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ykxhc3RFeGl0Tm9ybWFs","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yk51bGxEb2NNYXhpbWl6ZWQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YlByb3RlY3RlZE1vZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJlYWtPbkluaXRpYWxpemVQcm9jZXNzRmFpbHVyZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzY5Y2I3MGEtMzEzMy00Y2NhLWFiMGUtMDQ2ODQ4ZWZmY2Rh","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxwb3dlcnNoZWxsLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0ZHT3B0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2c7aikjMG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXBX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$5a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NpY1NoZWxs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVHdWlk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDb250ZXh0VG9rZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFNpZFRvU3RyaW5nU2lkVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4X1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3NfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtQWxsb2M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtRnJlZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29XYWl0Rm9yTXVsdGlwbGVIYW5kbGVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3B5Kk4/Sn0sbU5d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$5b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQWN0Q3R4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQm91bmRhcnlEZXNjcmlwdG9yVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29uZmlnU3RyZWFt","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29uZmlnU3RyZWFtX1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJpdmF0ZU5hbWVzcGFjZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2FpdGFibGVUaW1lckV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2VsbEtub3duU2lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$5c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$5d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDFmOGMxYTctODE0OS00NjliLWI1ZjYtN2QzMGRlZWRiZGI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGIzMGU5ZGMtMzU0ZC00OGI1LTlkYzAtYWVhZWJjNWM2YjU0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZEJ7U0B9XV4h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RENtcmNOei1Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGVhY3RpdmF0ZUFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdQcm9jZXNzSGVhcE9ubHk=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmZXJQcmVjcmVhdGVBbmRSZWRpcmVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVkTnRkbGw=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQm91bmRhcnlEZXNjcmlwdG9y","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlckV2ZW50U291cmNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVTS1RPUC04TEQ5VDZO","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$5e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$5f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUFudGlTcHl3YXJl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUFudGlWaXJ1cw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZURvdWJsZVF1ZXJ5U2Ricw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUV4Y2VwdGlvbkNoYWluVmFsaWRhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUhlYXBMb29rYXNpZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsQWRtaW5NZXJnZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVByb2Nlc3NJc29sYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcGxheWVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"$60","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGxsR2V0Q2xhc3NPYmplY3RJbnRlcm5hbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGxsU3Vycm9nYXRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udE1hcmtQb3N0U2NyaXB0Sm9i","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFNob3dTdXBlckhpZGRlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZHBhZ2VWaWV3Wm9vbQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHBpQXdhcmVuZXNz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RFBMUHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0Ryb3BFeHRlbnNpb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW5FeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW5FeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZSU+b1J7UilR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$61","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZTRiNzAzNzItMjYxZi00YzU0LThmYTYtYTVhNzkxNGQ3M2Rh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RTdvXk0ucHE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZVtmJ3Z9P0ou","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZV5qPyhEVDZBXD1ERUtWcGkpb3hqYz1faEcjJzo7ZytYZzNeTUJQV100InU0fDAmX0tIZlkkTXg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"Annssi.dat","compromised":null,"detection_total":null,"total":null},{"value":"ZWE5ZTgxNTUtNTA0Mi01NTM3LTBiNzMtOGMwZTZiNTNmMzk4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhNzg5ZDktNTMzYi01OGQ0LWNkMWYtMmU2NTIwZTNhOWMy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWZmZWN0aXZl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"$62","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUmVtb3RlTWFuYWdlZERlZmF1bHRz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IFRydXN0ZWQgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5kc3RyZWFtZW5kb2JqMiAwIG9iajw8IC9MZW5ndGggNDcgPj5zdHJlYW1xIDU5NC45NiAwIDAgODM4LjA4IDAuMDAgMC4wMCBjbSAxIGcgL0ltMSBEbyBRZW5kc3RyZWFtZW5kb2JqMyAwIG9iajw8L1R5cGUgL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODM5XS9QYXJlbnQgNCAwIFIgL1JvdGF0ZSAwIC9SZXNvdXJjZXMgPDwvUHJvY1NldCBbL1BERiAvSW1hZ2VDIC9JbWFnZUIgL0ltYWdlSV0vWE9iamVjdCA8PC9JbTEgMSAwIFIgPj4gPj4vQ29udGVudHMgWyAyIDAgUl0vQXJ0Qm94IFswIDAgNTk1IDgzOV0+PmVuZG9iajUgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0yIC9XaWR0aCAyNDgyIC9IZWlnaHQgMzUwMiAvTGVuZ3RoIDY0NjI4OC9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNhbGVuZGFySW5mb0V4RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRpbWVGb3JtYXRzRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW9QRkdcUkB8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRBY3Rpdml0eUlkQ29udHJvbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRXcml0ZVRyYW5zZmVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZU9wdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjE2OGQyZmEtNTY0Mi01OGJiLTM2MWUtMTI3OTgwYzY0YTFi","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$63","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zjg1YjQ3OTMtMTM0Ny01NjIwLTc1NzItYjc5ZDVhMjhkYTgy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmIyYTZkM2YtMDg5Ni01MzJlLTc3ZmMtMmQ5MTkxZDFjNzE3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmYzMmFkYTEtNWE0Yi01ODNjLTg4OWUtYTNjMDI3YjIwMWY1","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlndXJlcy4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5MU1N0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxlX0VkdF9WaWV3","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVmFsdWVGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm9sbG93aW5n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbnRFbmRIZWFwRGVidWdPcHRpb25z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnVUJSNpN3dO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$64","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$65","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$66","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R2RpU2NhbGluZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FsZW5kYXJJbmZvRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm9X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVdpbmRvdw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudEFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHluYW1pY1RpbWVab25lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU1VSVBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TnVtYUhpZ2hlc3ROb2RlTnVtYmVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFwX1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtV2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeV9SZXRBZGRy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$67","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmxhZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmxhZzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R082L30sUWlyJQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R29jXlouIUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Z292ZXJubWVudCw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$68","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Z1ZvLXBPNHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$69","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SCdcOjFSPyo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SD1HSkMydE9o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$6f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$70","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$71","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$72","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$73","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$74","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$75","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUdoNWVIUjRlSGowUjNoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGc9Iik7IGZvciAoaW50IGkgPSAwOyBpIDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$76","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$77","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$78","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SEtwRH5AIz9TWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$79","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SSRIY2kkdVRR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"aSxlJEV1PUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$7f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$80","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$81","type":"Ansi","source":"Process Commandline","process":"powershell.exe","filename":"00000000-00001412","compromised":null,"detection_total":null,"total":null},{"value":"aUY5PTNIYE47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTc=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFjbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbERhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExvY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5zdGl0dXRpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdHJ1Y3Rpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVByb3RlY3RlZFZpZXc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVFOM28oPTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNUYWJsZXRQQw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWlsQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVYsSWtIJz8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ajkkSGNpJHVUUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SmFFOU45LV1V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$82","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"aml0U3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"am1gQV8qfE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$83","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"alFQW11bXkIl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ayZ4NTlmbXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SytudmBOTW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"azQ3UlxHZzR7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"azhsXilkO0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFjdGl2YXRpb25Db250ZXh0c0FsaXZl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$84","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"S0g6c0tSUFFF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"a09nPC03OStJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"S3Frd2JgPCI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$85","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"a3YtYXMrbFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bCg/WnFEJXI6dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TEAwc0tFJSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$86","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoUGVybWlzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoVXNlck9PQkU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGR2dzEpZm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5RG9zRGV2aWNlUGF0aHM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5SW1wZXJzb25hdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGhaQnAzS0hz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$87","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFVzZXJTZXR0aW5ncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXR0aW5nT3ZlcnJpZGVEaXNhYmxlUmVhbHRpbWVNb25pdG9yaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nU3RhZ2VkRmVhdHVyZVVzYWdl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHdwJW9MdjU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$88","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TSEiSV40MWE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TSNGOTswc08=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TS5XbkghfSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TTFdIHlkXlw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTU9MGpeI2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTZNOkdMLGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTk/WnA8Zz16VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$89","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlZERlZmVuZGVyUHJvZHVjdFR5cGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4RGVhZEFjdGl2YXRpb25Db250ZXh0cw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4TG9hZGVyVGhyZWFkcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UmVzeW5jQXR0ZW1wdHM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$8a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TUdPVEZsYWdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlncmF0ZVByb3h5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluaW11bVN0YWNrQ29tbWl0SW5CeXRlcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW9KcSg8SWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvclJlZ2lzdHJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpQ2xvc2VTZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpTm90aWZ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpU2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDYW1wUmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDbGllbnRVdGlsRXhwb3J0RnVuY3Rpb25z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdDbG9zZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZUFsbG9j","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdPcGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdSZWdpc3RlckZvck5vdGlmaWNhdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdVbnJlZ2lzdGVyTm90aWZpY2F0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBFbmdpbmVSaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbk9wZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGcmVlTWVtb3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBIYW5kbGVDbG9zZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNYW5hZ2VyT3Blbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNYW5hZ2VyVmVyc2lvblF1ZXJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNZW1vcnlTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuUmVzdWx0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTaWduYXR1cmVSaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBUaHJlYXRFbnVtZXJhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBUaHJlYXRPcGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXU8IiZPOyJRIHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$8b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$8c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bmNhY25fbnA6W1xcUElQRVxcc3J2c3ZjLFNlY3VyaXR5PUltcGVyc29uYXRpb24gRHluYW1pYyBGYWxzZV0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbZXZlbnRsb2dd","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTdd","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpba2V5c3ZjXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbnRzdmNzXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkVUV09SSyBTRVJWSUNF","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$8d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$8e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$8f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db250cm9sUGFuZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$91","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcm5ldEljb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9ybWFsaXplTGlua05ldFBpZGxz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TZXRGb2xkZXJz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9XZWJWaWV3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnJ9cUhnbUVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TlQgQVVUSE9SSVRZ","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeUluZm9ybWF0aW9uVGhyZWFk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVduZlN0YXRlRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRTZXRTeXN0ZW1JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"byEkYyBceWE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bzV7eC86eU5INQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bz9ofVplbyxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"T0AoR1kjV15V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"T0VNIGVTSU0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllcw==","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFQ0NGRTNGRjVGRUVDOTcxOTc4Q0RGMjMzMjk2NQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T25TaGltRGxsTWFpbkNhbGxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByaXZhdGVOYW1lc3BhY2VX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$92","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"b8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWVfMzYzNTQ0ODk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFydG5lckdVSUQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFzc2l2ZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzTmV0d29ya1BhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzTmV0d29ya1BhdGhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyUHJvY2Vzc1N5c3RlbURwaQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$94","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UEhJTElQUElORQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UGhpbGlwcGluZQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UEhJTElQUElORVM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UElMSVBJTkFTLg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"cG93ZXJzaGVsbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkU2VydmVyQml0bmVzcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpbnRUb0ZpbGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdklzRGxsU3luY2hyb25pemF0aW9uSGVsZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01pdGlnYXRpb25Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdEFwcERhdGFQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGlyICh4ODYp","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHNhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHllQ00kWDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UWhhIDxbRVRbPixVI28gKA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"Annss.dat","compromised":null,"detection_total":null,"total":null},{"value":"UUhhTHBJXHY9aQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$95","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"cU1YUCJubG0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlBY3RDdHhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlVbmJpYXNlZEludGVycnVwdFRpbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVpcmtHZXREYXRhMg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVpcmtJc0VuYWJsZWQz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$96","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UXwmaz1FU2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"cjtxVntVPU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VBY3RpdmF0aW9uQXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb25PblBvc3NpYmxlRGVhZGxvY2s=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVmZXJlbmNl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENhbGxiYWNr","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENsZWFudXBDYWxsYmFjaw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlIERlc2t0b3A=","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVyTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UkVQVUJMSUM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZUxvY2FsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzeW5jUmVzZXRUaW1l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$97","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRBY3RpdmF0aW9uRmFjdG9yeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRQYXJhbWV0ZXJpemVkVHlwZUluc3RhbmNlSUlE","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9Jbml0aWFsaXpl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Uk9URmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9VbmluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjQ2FjaGVUaW1lb3V0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjUnVudGltZUNvbmZpZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjU2VydmVyVXNlRW5kcG9pbnRNYXBwZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGlzb3duTW9kdWxlSGVhcEFsbG9jYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGxsU2h1dGRvd25JblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUXVlcnlGZWF0dXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVnaXN0ZXJGZWF0dXJlQ29uZmlndXJhdGlvbkNoYW5nZU5vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW5yZWdpc3RlckZlYXR1cmVDb25maWd1cmF0aW9uQ2hhbmdlTm90aWZpY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnVuQmluYXJ5Q29udHJvbEhvc3RQcm9jZXNzSW5TZXBhcmF0ZUFwcENvbnRhaW5lcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$98","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDbG9zZUxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDb21wdXRlVG9rZW5Gcm9tTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJJZGVudGlmeUxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXR5IFdhcm5pbmcgTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0UlayJHUyxr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoUGF0aE1vZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXIzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlQXV0b1Byb3h5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk9SW1wZXJzb25hdGlvbiBEeW5hbWljIEZhbHNl","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZERuc1RvSG9zdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vuc2VFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vuc2VPcmdJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVyVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRpdGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0UnVudGltZUluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2hlbGxTaGltSW5zdGFuY2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3lzdGVtRmlsZUNhY2hlU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnlfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lckV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0YyXDMwbjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U0g/c2xXc3c4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mb1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hsd2FwaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N0YXR1c0Jhcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2h1dGRvd25GbGFncw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2lnbmF0dXJlcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"c0luZm9CdWJibGVMYXN0RGlzcGxheWVkVGltZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xRVilJb3Vr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlCYXNlWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlNYXhZaWVsZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTbGVlcExvb3BXaW5kb3dTaXpl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTcGluQ291bnRUaHJlc2hvbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RmFjdG9yWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1ByZXZJUE1EZWZhdWx0TXNnU3luY1ZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3ByaXRlRmlsbENvbG9y","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1Byb29maW5nU3BhY2U=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1JQVHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRfSnVtcExpc3RJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRfTm90aWZ5TmV3QXBwcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRNZW51X1N0YXJ0X1RpbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1RBVElTVElDUw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"U3RhdGlzdGljcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3ZjVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3hzSml0U3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lzbWFpbi5zZGI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lzTWVyZ2Uuc2Ri","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzU3RyaW5nQnl0ZUxlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dCQ0fSVnbi0sLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEFjdGl2ZVNldHRpbmdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEJ1aWx0SW5QZXJtTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGNTZXR0aW5n","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dERpc3RNZXRob2Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGZpcnN0VXNlQWNjb3JkaW9u","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEZsYXNoQ29udGVudFNjaGVtZVdoaXRlTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEtDT1BoUHI1eXlQRDMxWmVuUEVGQVE9PQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX0Fkb2JlQVJN","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX1JlYWRlcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFFILn0nb3VvdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2luZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tBY3RpdmF0aW9uQ29udGV4dFJlbGVhc2Vz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RlZCBEZXZpY2Vz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RlZCBQYWNrYWdlZCBBcHAgSW5zdGFsbGF0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNjaGVtZVBlcm1z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNlYXJjaEF0dGFjaG1lbnRzV2hpdGVMaXN0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHNlbGVjdGVkbEFjY29yZGlvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHNlcnZpY2VzQXV0b21hdGlvblJ1bm5pbmc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNwb25zb3JlZENvbnRlbnRTY2hlbWVXaGl0ZUxpc3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX0Fkb2JlQVJN","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX1JlYWRlcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHVybk9mZlNQSUFuaW1hdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFdoaXRlTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFlWPWtPZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dT0zVztzWH4m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2FkRXZlbnRUcmFjZURlcHRo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5tYXBWaWV3T2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRmlsdGVy","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSW1wZXJzb25hdGVkRGV2aWNlTWFw","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSW5Qcm9jSGFuZGxlckNhY2hl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT3V0T2ZQcm9jSGFuZGxlckNhY2hl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlcmVudkRlYnVnTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNpbmcgU3lzdGVtLlJlZmxlY3Rpb247ICAgICAgICAgICAgICAgICAgICB1c2luZyBNaWNyb3NvZnQuV2luMzI7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgY2xhc3MgSk1DUVlzWkVRTlRBd1VTcFJ0RE5EeEIgOiBUYXNrLCBJVGFzayAgICAgICAgICAgICAgICAgICAgeyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgiS2VybmVsMzIuZGxsIildIHByaXZhdGUgc3RhdGljIGV4dGVybiBJbnRQdHIgR2V0Q29uc29sZVdpbmRvdygpOyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgidXNlcjMyLmRsbCIpXSBwcml2YXRlIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLCBJbnQzMiBuQ21kU2hvdyk7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgb3ZlcnJpZGUgYm9vbCBFeGVjdXRlKCkgICAgICAgICAgICAgICAgICAgIHsgICAgICAgICAgICAgICAgICAgIHRyeSB7IEludFB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Vj1Pc0oyUHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWdJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVyaWZpY2F0aW9u","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"VmVyTGFuZ3VhZ2VOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyTGFuZ3VhZ2VOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$99","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$9a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VzFcNENxW3dkZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0JLNFFFSUFF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"d0VQVGlWO308","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V2VyUmVnaXN0ZXJSdW50aW1lRXhjZXB0aW9uTW9kdWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2VyU2V0RmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZ1JlZmVyZW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0RlbGV0ZVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c1Bvd2VyU2hlbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cExvd2VyQ2FzZUhvc3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2ludHJ1c3QuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luVmVyaWZ5VHJ1c3Q=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luVmVyaWZ5VHJ1c3RX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2xkcEdldExvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RHZXRTaWduYXR1cmVJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWlu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWluVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGE=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGFX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WCc/OTV2PT1M","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eDV1fD1hNC0o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eD1pSmQoLkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$9b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$9c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eHBhZ2VWaWV3QmVhZA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eHdpbmRvd0ZyYW1l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$9d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"WUhgSSNVby87UGcl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$9e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"WmAtQXNuLi0m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"emkwRSo8WUVe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"endFZ0ZlcFVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eyRfLk5hbWUgLWxpa2UgJGUgLWFuZCAkXy5MZW5ndGggLWVxIDE4OTg5MTJ9","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"ezBEREQwMTVELUIwNkMtNDVENS04QzRDLUY1OTcxMzg1NDYzOX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezM1Mjg2QTY4LTNDNTctNDFBMS1CQkIxLTBFQUU3M0Q3NkM5NX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEODNFRTlCLTIyNDQtNEU3MC1CMUY1LTUzOTMwNDJBRjFFNH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e1xKUiRGOWVQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"e0EwQzY5QTk5LTIxQzgtNDY3MS04NzAzLTc5MzQxNjJGQ0YxRH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MjBBMUE0LTE3ODAtNEZGNi1CRDE4LTE2NzM0M0M1QUYxNn0=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MkJCQTQ2LUU5RTEtNDM1Ri1CM0Q5LTI4REFBNjQ4QzBGNn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0Y0MkVFMkQzLTkwOUYtNDkwNy04ODcxLTRDMjJGQzBCRjc1Nn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0wzRzxLLFIr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"e1pBS0BHSlpOaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fCFjcD46XUw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fEFqdE1RZGs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fE8zSGRme0JU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fSFFJk56Vzc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fSttVl5jP1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fXRjXklxIDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fid4W1BNL0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"IiVURU1QJVxBZHZpc29yeTIzLVVDRE1TMDQtMTEtMDEucGRmIg==","type":"Ansi","source":"Process Commandline","process":"AcroRd32.exe","filename":"AcroRd32.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVXSU5ESVIlXE1pY3Jvc29mdC5ORVRcRnJhbWV3b3JrNjRcdjQuMC4zMDMxOVxNU0J1aWxkLmV4ZSIgJVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IjZwLkFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IiVQUk9HUkFNRklMRVMlXCh4ODYpXEFkb2JlXFJlYWRlciAxMS4wXFJlYWRlclxBY3JvUmQzMi5leGUiICIlVEVNUCVcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZiI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTVBDTElFTlQuRExM","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTXNNcExpY3MuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5BcHBsaWNhdGlvbkNvbXBhbnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5GcmllbmRseUFwcE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQU1JlYWRMaW5lXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Ansi","source":"Process Commandline","process":"MSBuild.exe","filename":"MSBuild.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo0","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcZjQ4ODlmYTAzMmY4MDIzZmUyODBhNTQ3MDBkNmQzYTVcTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcNDY4ZmE1YWU4NDk5MWFhZjRkOTBlY2VlODc4OGYwMjRcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcNDk3NTBlYTAzODI3M2Y3NTMyMWU0NzllZjE1MjVkMWVcTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcOTQ5NGVkYTBjOWFmNTAzY2I2MWZlNDUwYjViYTljMWFcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcODZhZjJmNGYyNzQ1NzM4ODM3Yzk1ZjI0NDcyYzMyY2FcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUg=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcM2I5MDAzZTRmMjdkOTJlNDA2NjhmMGVmYWQxMWUwMjJcbXNjb3JsaWIubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcYjRjMzQ1MjNjNTgyMTQ2ZGVhM2NhMzg5ZTM0ODcxNDVcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cMmEyNWI1OTg3MmE3MmRhOWI1NWY5NTJhYjFiMGJjOGJcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcOTkwNTAxZTYxOTk4MTk4MDZmMDFjOGVjYWM4OGJhYWNcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcYmYzZDJlNjA0MmQ5NDNlMGZlYzljY2MwZDcyYzhmM2JcU3lzdGVtLkRhdGEubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcMmQxZmYyYWIzMTMxZGU2YTUwN2YyMmNjYzUzYjI3M2FcU3lzdGVtLkRpcmVjdG9yeVNlcnZpY2VzLm5pLmQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcZWE4OTNkN2UzMzZhMTk2YzkyN2MzZjEyNTFhMWQxYTlcU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbi4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcNjI4N2UwOTAxNWEzMTFhNjRjNGZlMDMwNDgxOGY4YzNcU3lzdGVtLk1hbmFnZW1lbnQubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk51bWVyaWNzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1xkZDBlZDc5NWQ3MjM0YTJhZTQzMTRkZTA1Mjg2NzE2MVxTeXN0ZW0uVHJhbnNhY3Rpb25zLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFxmMDA3OGM4YzA1YjMxNjMzZTU5NjZjNTYyOWU2NTYwMlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGNlMGZkNGY1YjUwYmFhMTdlN2I4MGU0ZWU4NzRhZDExXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNvbWJhc2UuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG9sZWF1dDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNlY3VyMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNoZWxsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLkRhdGFcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XFN5c3RlbS5EYXRhLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1x2NC4wXzQuMC4wLjBfX2I3N2E1YzU2MTkzNGUwODlcU3lzdGVtLlRyYW5zYWN0aW9ucy5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVxzaGx3YXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVx3aW50cnVzdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFxcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCpkLipl","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1yb3BhcmFtZXRlcml6ZWRpaWQtbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1zdHJpbmctbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNsci5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNscmppdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XENSWVBUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuLVVTXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE1TQnVpbGQuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWUuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWVpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG9sZTMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE9MRUFVVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XFZFUlNJT04uZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZW4tVVNcdHpyZXMuZGxsLm11aQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcU29ydC1PYmplY3QuKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLlV0aWxpdHlcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2luZG93c3Bvd2Vyc2hlbGxcdjEuMFxwb3dlcnNoZWxsX2lzZS5leGU=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"KEB9TVR1LVtP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KS5HZXRUeXBlKCJTeXN0ZW1SdW50aW1lLlByb2dyYW0iKS5HZXRNZXRob2QoIk1haW4iKS5JbnZva2UobnVsbCxuZXcgb2JqZWN0W117bmV3IHN0cmluZ1tdeyJZbGRiVVZOUVYxQmEiLCJaZzRTRWhaY1NVa0FEd29ERlVnV0RnOEtCQU1JQWdNRkRVZ0ZDUXRKIiwiTVZsRlJVRkNDeDRlVjFoZFZFSWZRVmxZWFZOVVgxVlVVbG9mVWw1Y0hnPT0iLCI0MSIsIjUyIiwiNTEzMyJ9fSk7fWNhdGNoe30gcmV0dXJuIHRydWU7ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L0NvZGU+ICAgICAgICAgICAgICAgIDwvVGFzaz4gICAgICAgICAgICA8L1VzaW5nVGFzaz4gICAgICAgIDwvUHJvamVjdD4lUERGLTEuNzEgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0xIC9XaWR0aCAyNDc5IC9IZWlnaHQgMzQ5MiAvTGVuZ3RoIDU4MDI4Ni9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KUVudmlyb25tZW50LkV4aXQoLTEpO1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LlN0YXJ0KCk7Ynl0ZVtd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L0M6XEFEVklTT34xLkxOS0M6XEFkdmlzb3J5MjMtVUNETVMwNC0xMS0wMS5wZGYubG5rZHRsNGRyYzhqN3p4aXNiMVNQUzFTUFN8TylEdjwgLXVWLyVXSU5ESVIlXHlzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vi9DOlxXaW5kb3dzU3lzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"DH7716QWUQ6F416J2N8H.temp","compromised":null,"detection_total":null,"total":null},{"value":"$9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MGJjYTQ3ODQtODI1Ny01MWEwLWQ5ZWMtMjRmZTFmZTRjOTBk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTg2MDhlNjItYTYyOC00OWQ5LThjMDItNTU5NzJlMDk3ZDI0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MzcyMGRkYTctY2FlYS00YWYzLWExMzgtMzc1YWFmYzNmMWQ2","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzgyYjVlMjQtMTgxZS00MTdmLWE4ZDYtMjE1NWY3NDllNzI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzlkZGNiOGQtZWY4Mi01Yzg0LTg5Y2EtMDk1ODBiZjBhOTQ3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NCttU3lzdGVtLk51bWVyaWNzTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QwODN+dkdTeXN0ZW1TeXN0ZW0uQ29yZVN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb25MTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHJ1Y3R1cmVTeXN0ZW0uTWFuYWdlbWVudFN5c3RlbS5EaXJlY3RvcnlTZXJ2aWNlczRTeXN0ZW0uWG1sU3lzdGVtLkRhdGFTeXN0ZW0uQ29uZmlndXJhdGlvbkgmJ0h4LU1pY3Jvc29mdC5Qb3dlclNoZWxsLlNlY3VyaXR5U3lzdGVtLlRyYW5zYWN0aW9uc01pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbW1hbmRzLk1hbmFnZW1lbnREU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbFBNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5","type":"Ansi","source":"File String Dumps","process":null,"filename":"StartupProfileData-NonInteractive","compromised":null,"detection_total":null,"total":null},{"value":"NDg4OTVDMjQwODQ4ODk3NDI0MTA1NzQ4ODNFQzIwOEIwNUUzNzQ4NTAwMzNEQjQ4OEJGOTg1QzAwRjg1OTUwMDAwMDAzODFEQThERDg0MDAwRjg1ODkwMDAwMDBGRjE1QzRCNjY3MDA0ODhCMEQyNUUwODQwMDhCRjA0ODg1Qzk3NDFDNDg4QjAxNEM4QjA3NDg4QjU3MDg0ODhCODBCMDAyMDAwMEZGMTU1N0JGNjcwMDgzRjhGRjc0NTQ0ODhCMEY4MTM5MDYwMDAxNDA3NDRFODEzOTg4MTM2RDQwNzQ0NjQ4OEI1NzA4RThDMkZFRkZGRkU4MzE4QzBDMDA0ODg1QzA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$a8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$a9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NGU3YWRkMWEtNjk0NS00MzVhLTgyYjYtNjEyNjg4YmE5ZjU3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$aa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWViNjBiMzYtNjIwNi01NTM4LWU2MGEtMGE3YWY4YTFlNTlk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OGNjY2EyN2QtZjFkOC00ZGRhLWI1ZGQtMzM5YWVlOTM3NzMx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"PDNeLlx9TX06MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ab","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ac","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PUdldENvbnNvbGVXaW5kb3coKTtTaG93V2luZG93KA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PW5ldyBNdXRleCh0cnVlLCJ7MjNCNEQ1NzYtMTU0Ny00MzlDLUIxMDctOUFCNUUyOEU5NDlCfSIsb3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxTZXNzRW52LmRsbCwtMTAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXFN5c1dPVzY0XEFwcHhQYWNrYWdpbmcuZGxsLC0xMDAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QHcucEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldID0gKGJ5dGUpKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldIF4gMTIwKTt9QXNzZW1ibHkuTG9hZCg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XFwuXHBpcGVcUFNIb3N0LjEzMzY1ODAxMzE5NTQ5MTA0Mi4xNDEyLkRlZmF1bHRBcHBEb21haW4ucG93ZXJzaGVsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcUHJvZ3JhbSBGaWxlcyAoeDg2KVxBZG9iZVxSZWFkZXIgMTEuMFxSZWFkZXJcQWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29yazY0XHY0LjAuMzAzMTlcTVNCdWlsZC5leGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XGlWV1NIflt7eCMuRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XFBJUEVcc3J2c3Zj","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ad","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YTQwYjQ1NWMtMjUzYy00MzExLWFjNmQtNmU2NjdlZGNjZWZj","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkU0lEVG9Cb3VuZGFyeURlc2NyaXB0b3I=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"YUVzPjs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUNsb3NlU2Vzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaU9wZW5TZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVNjYW5CdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVVuaW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXF1aXJrcy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXJvcGFyYW1ldGVyaXplZGlpZC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXN0cmluZy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwY29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0Q2xyQ29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ae","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YjE2NDI1OTctMjg1ZS01NjBhLTdmNjAtN2UwMmY1ZGEyMmMw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$af","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJlYWtPbkluaXRpYWxpemVQcm9jZXNzRmFpbHVyZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzY5Y2I3MGEtMzEzMy00Y2NhLWFiMGUtMDQ2ODQ4ZWZmY2Rh","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxwb3dlcnNoZWxsLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDb250ZXh0VG9rZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4X1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3NfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQm91bmRhcnlEZXNjcmlwdG9yVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$b3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDFmOGMxYTctODE0OS00NjliLWI1ZjYtN2QzMGRlZWRiZGI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGIzMGU5ZGMtMzU0ZC00OGI1LTlkYzAtYWVhZWJjNWM2YjU0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZEJ7U0B9XV4h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdQcm9jZXNzSGVhcE9ubHk=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQm91bmRhcnlEZXNjcmlwdG9y","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlckV2ZW50U291cmNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$b5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsQWRtaW5NZXJnZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVByb2Nlc3NJc29sYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RGxsR2V0Q2xhc3NPYmplY3RJbnRlcm5hbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udE1hcmtQb3N0U2NyaXB0Sm9i","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZTRiNzAzNzItMjYxZi00YzU0LThmYTYtYTVhNzkxNGQ3M2Rh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZV5qPyhEVDZBXD1ERUtWcGkpb3hqYz1faEcjJzo7ZytYZzNeTUJQV100InU0fDAmX0tIZlkkTXg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"Annssi.dat","compromised":null,"detection_total":null,"total":null},{"value":"ZWE5ZTgxNTUtNTA0Mi01NTM3LTBiNzMtOGMwZTZiNTNmMzk4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhNzg5ZDktNTMzYi01OGQ0LWNkMWYtMmU2NTIwZTNhOWMy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUmVtb3RlTWFuYWdlZERlZmF1bHRz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IFRydXN0ZWQgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5kc3RyZWFtZW5kb2JqMiAwIG9iajw8IC9MZW5ndGggNDcgPj5zdHJlYW1xIDU5NC45NiAwIDAgODM4LjA4IDAuMDAgMC4wMCBjbSAxIGcgL0ltMSBEbyBRZW5kc3RyZWFtZW5kb2JqMyAwIG9iajw8L1R5cGUgL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODM5XS9QYXJlbnQgNCAwIFIgL1JvdGF0ZSAwIC9SZXNvdXJjZXMgPDwvUHJvY1NldCBbL1BERiAvSW1hZ2VDIC9JbWFnZUIgL0ltYWdlSV0vWE9iamVjdCA8PC9JbTEgMSAwIFIgPj4gPj4vQ29udGVudHMgWyAyIDAgUl0vQXJ0Qm94IFswIDAgNTk1IDgzOV0+PmVuZG9iajUgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0yIC9XaWR0aCAyNDgyIC9IZWlnaHQgMzUwMiAvTGVuZ3RoIDY0NjI4OC9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNhbGVuZGFySW5mb0V4RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZU9wdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjE2OGQyZmEtNTY0Mi01OGJiLTM2MWUtMTI3OTgwYzY0YTFi","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$b9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zjg1YjQ3OTMtMTM0Ny01NjIwLTc1NzItYjc5ZDVhMjhkYTgy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmIyYTZkM2YtMDg5Ni01MzJlLTc3ZmMtMmQ5MTkxZDFjNzE3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmYzMmFkYTEtNWE0Yi01ODNjLTg4OWUtYTNjMDI3YjIwMWY1","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ba","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$bb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$bc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FsZW5kYXJJbmZvRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm9X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVdpbmRvdw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudEFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHluYW1pY1RpbWVab25lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU1VSVBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TnVtYUhpZ2hlc3ROb2RlTnVtYmVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFwX1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtV2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeV9SZXRBZGRy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$bd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$be","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$bf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$c9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ca","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$cb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUdoNWVIUjRlSGowUjNoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGc9Iik7IGZvciAoaW50IGkgPSAwOyBpIDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$cc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$cd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ce","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$cf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d6","type":"Ansi","source":"Process Commandline","process":"powershell.exe","filename":"00000000-00001412","compromised":null,"detection_total":null,"total":null},{"value":"SU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTc=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbERhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExvY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW5zdGl0dXRpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdHJ1Y3Rpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$d7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$d9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$da","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$db","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXR0aW5nT3ZlcnJpZGVEaXNhYmxlUmVhbHRpbWVNb25pdG9yaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$dc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TS5XbkghfSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$dd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$de","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TWluaW11bVN0YWNrQ29tbWl0SW5CeXRlcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvclJlZ2lzdHJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpQ2xvc2VTZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpTm90aWZ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpU2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDbGllbnRVdGlsRXhwb3J0RnVuY3Rpb25z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZUFsbG9j","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdSZWdpc3RlckZvck5vdGlmaWNhdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdVbnJlZ2lzdGVyTm90aWZpY2F0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbk9wZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNYW5hZ2VyVmVyc2lvblF1ZXJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNZW1vcnlTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuUmVzdWx0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$df","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$e0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bmNhY25fbnA6W1xcUElQRVxcc3J2c3ZjLFNlY3VyaXR5PUltcGVyc29uYXRpb24gRHluYW1pYyBGYWxzZV0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTdd","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpba2V5c3ZjXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkVUV09SSyBTRVJWSUNF","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$e2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$e3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeUluZm9ybWF0aW9uVGhyZWFk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRTZXRTeXN0ZW1JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$e6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UGVyUHJvY2Vzc1N5c3RlbURwaQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01pdGlnYXRpb25Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UXVpcmtHZXREYXRhMg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$e9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENhbGxiYWNr","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENsZWFudXBDYWxsYmFjaw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlIERlc2t0b3A=","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVyTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZUxvY2FsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRBY3RpdmF0aW9uRmFjdG9yeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRQYXJhbWV0ZXJpemVkVHlwZUluc3RhbmNlSUlE","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVnaXN0ZXJGZWF0dXJlQ29uZmlndXJhdGlvbkNoYW5nZU5vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW5yZWdpc3RlckZlYXR1cmVDb25maWd1cmF0aW9uQ2hhbmdlTm90aWZpY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnVuQmluYXJ5Q29udHJvbEhvc3RQcm9jZXNzSW5TZXBhcmF0ZUFwcENvbnRhaW5lcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ea","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDb21wdXRlVG9rZW5Gcm9tTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0UnVudGltZUluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2hlbGxTaGltSW5zdGFuY2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnlfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mb1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c0luZm9CdWJibGVMYXN0RGlzcGxheWVkVGltZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1ByZXZJUE1EZWZhdWx0TXNnU3luY1ZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3ZjVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RlZCBQYWNrYWdlZCBBcHAgSW5zdGFsbGF0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHNlcnZpY2VzQXV0b21hdGlvblJ1bm5pbmc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNpbmcgU3lzdGVtLlJlZmxlY3Rpb247ICAgICAgICAgICAgICAgICAgICB1c2luZyBNaWNyb3NvZnQuV2luMzI7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgY2xhc3MgSk1DUVlzWkVRTlRBd1VTcFJ0RE5EeEIgOiBUYXNrLCBJVGFzayAgICAgICAgICAgICAgICAgICAgeyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgiS2VybmVsMzIuZGxsIildIHByaXZhdGUgc3RhdGljIGV4dGVybiBJbnRQdHIgR2V0Q29uc29sZVdpbmRvdygpOyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgidXNlcjMyLmRsbCIpXSBwcml2YXRlIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLCBJbnQzMiBuQ21kU2hvdyk7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgb3ZlcnJpZGUgYm9vbCBFeGVjdXRlKCkgICAgICAgICAgICAgICAgICAgIHsgICAgICAgICAgICAgICAgICAgIHRyeSB7IEludFB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWdJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$eb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ec","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V2VyUmVnaXN0ZXJSdW50aW1lRXhjZXB0aW9uTW9kdWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZ1JlZmVyZW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cExvd2VyQ2FzZUhvc3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2xkcEdldExvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RHZXRTaWduYXR1cmVJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWlu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWluVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGE=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGFX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ed","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ee","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eHdpbmRvd0ZyYW1l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$ef","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eyRfLk5hbWUgLWxpa2UgJGUgLWFuZCAkXy5MZW5ndGggLWVxIDE4OTg5MTJ9","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"ezBEREQwMTVELUIwNkMtNDVENS04QzRDLUY1OTcxMzg1NDYzOX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezM1Mjg2QTY4LTNDNTctNDFBMS1CQkIxLTBFQUU3M0Q3NkM5NX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEODNFRTlCLTIyNDQtNEU3MC1CMUY1LTUzOTMwNDJBRjFFNH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0EwQzY5QTk5LTIxQzgtNDY3MS04NzAzLTc5MzQxNjJGQ0YxRH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MjBBMUE0LTE3ODAtNEZGNi1CRDE4LTE2NzM0M0M1QUYxNn0=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MkJCQTQ2LUU5RTEtNDM1Ri1CM0Q5LTI4REFBNjQ4QzBGNn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0Y0MkVFMkQzLTkwOUYtNDkwNy04ODcxLTRDMjJGQzBCRjc1Nn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"Advisory23-UCDMS04-11-01.pdf.lnk","strings":[{"value":"ITIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ITJMWyB7VzE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IjZwLkFy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Ij8uMGNPKyF5Uw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"IlVePUU2TypGVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Izk/SlpiPkY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JGc7d1d4fj94cGk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JHRhQTg9KkpibQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Jk8+XzVLYXUs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Jzk9ODI8LjM0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J0paQj86MUA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J09KWik7cUA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"J3paaFw2e2I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KDcpLDAxNDQ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KEB9TVR1LVtP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KS5HZXRUeXBlKCJTeXN0ZW1SdW50aW1lLlByb2dyYW0iKS5HZXRNZXRob2QoIk1haW4iKS5JbnZva2UobnVsbCxuZXcgb2JqZWN0W117bmV3IHN0cmluZ1tdeyJZbGRiVVZOUVYxQmEiLCJaZzRTRWhaY1NVa0FEd29ERlVnV0RnOEtCQU1JQWdNRkRVZ0ZDUXRKIiwiTVZsRlJVRkNDeDRlVjFoZFZFSWZRVmxZWFZOVVgxVlVVbG9mVWw1Y0hnPT0iLCI0MSIsIjUyIiwiNTEzMyJ9fSk7fWNhdGNoe30gcmV0dXJuIHRydWU7ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICB9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L0NvZGU+ICAgICAgICAgICAgICAgIDwvVGFzaz4gICAgICAgICAgICA8L1VzaW5nVGFzaz4gICAgICAgIDwvUHJvamVjdD4lUERGLTEuNzEgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0xIC9XaWR0aCAyNDc5IC9IZWlnaHQgMzQ5MiAvTGVuZ3RoIDU4MDI4Ni9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KUVudmlyb25tZW50LkV4aXQoLTEpO1RocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Kjsob10sJXE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KkZ9K0UmaWg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KmkkSGNpJHVEUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KkowZGByTXs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"KlZlRSxIOSQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LCAwKTt2YXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LCFWYkkgdSY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LTBnTyZ4RjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LT5tX0dbTSY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LWlnIyxQRk9APw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LXQ9T19tN10=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LklzQmFja2dyb3VuZD10cnVlOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Lkxlbmd0aDsgaSsrKXs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"LlN0YXJ0KCk7Ynl0ZVtd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L3pAeyc1SXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"L34oeEF8Qyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MFt4c09WRGdI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MTIzNDU2Nzg5MC4xMjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MmRVfXY8NG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"MyopZiFUckk4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$f9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$fa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"M2xfYnJ8RSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$fb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"M1VebSo4WW5mRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$fc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$fd","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$fe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NEktZGVxLHlc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NjBpNV1mbT5l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"NzBaX1sgSSN5MDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$ff","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OCFEOVxVUXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OSFGcDBpcjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"OnwzRTxiSGRZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"O2chUlIoWV1H","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PDMhR19QaCU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PDNeLlx9TX06MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PEN7O3hTQlksYiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$100","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PSdTO3wlck5OLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PSsxPiJoOHY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PS9fPy53cik=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PUJFYzRSeWs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$101","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PWZhbHNlO3Zhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PUdldENvbnNvbGVXaW5kb3coKTtTaG93V2luZG93KA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PW5ldyBNdXRleCh0cnVlLCJ7MjNCNEQ1NzYtMTU0Ny00MzlDLUIxMDctOUFCNUUyOEU5NDlCfSIsb3V0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PW5ldyBUaHJlYWQoKCk9PntUaHJlYWQuU2xlZXAoMTgwKjEwMDApO1Byb2Nlc3MuU3RhcnQobmV3IFByb2Nlc3NTdGFydEluZm97QXJndW1lbnRzPUVuY29kaW5nLkFTQ0lJLkdldFN0cmluZyhDb252ZXJ0LkZyb21CYXNlNjRTdHJpbmcoIkwyTnlaV0YwWlNBdmMyTWdUVWxPVlZSRklDOXRieUF6TUNBdmMzUWdNRGM2TURBNk1EQWdMM1J1SUNKRGFISnZiV1ZEYjI1dVpXTjBhVzl1SWlBdmRISWdJbU50WkNBdll5QnpkR0Z5ZENBdmJXbHVJQ1YzYVc1a2FYSWxYRTFwWTNKdmMyOW1kQzVPUlZSY1JuSmhiV1YzYjNKck5qUmNkalF1TUM0ek1ETXhPVnhOVTBKMWFXeGtJQ1YwWlcxd0pWeERhSEp2YldWRGIyNXVaV04wYVc5dUlpQXZaZz09IikpLENyZWF0ZU5vV2luZG93PXRydWUsRXJyb3JEaWFsb2c9ZmFsc2UsRmlsZU5hbWU9InNjaHRhc2tzIixXaW5kb3dTdHlsZT1Qcm9jZXNzV2luZG93U3R5bGUuSGlkZGVuLH0pO30pOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PXBpQG5yRjti","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PX1oIyVAcjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PiZ4d1QsVWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PipdRlh0KyxN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PntsVFhlIkZYWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"PzV9NV8yfEU3Xg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P3FPUipjTUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P1pCeCBycU4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"P1piWkpaQ25OenE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QEk5PTNRbUo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"QHcucEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Wy4nXzZiRmNc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldID0gKGJ5dGUpKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W2ldIF4gMTIwKTt9QXNzZW1ibHkuTG9hZCg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"W3ZXPnFDIVw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XGlWV1NIflt7eCMuRw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"XzU0Wl06WUEs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Xz58Uzt+MmlSfQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"X3JHektUK1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YEt7aFdscUYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YSFmPzRMezV8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YSs6ez1KWCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$102","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YUVzPjs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YXZIPmJHcU0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$103","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$104","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YiA7Rls9KUAn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"YicmNCR3KilEMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$105","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Qj8vZCo2enFO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxwb3dlcnNoZWxsLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Y2c7aikjMG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$106","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Y3B5Kk4/Sn0sbU5d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$107","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$108","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$109","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZEJ7U0B9XV4h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RENtcmNOei1Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZSU+b1J7UilR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RTdvXk0ucHE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZVtmJ3Z9P0ou","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ZW5kc3RyZWFtZW5kb2JqMiAwIG9iajw8IC9MZW5ndGggNDcgPj5zdHJlYW1xIDU5NC45NiAwIDAgODM4LjA4IDAuMDAgMC4wMCBjbSAxIGcgL0ltMSBEbyBRZW5kc3RyZWFtZW5kb2JqMyAwIG9iajw8L1R5cGUgL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODM5XS9QYXJlbnQgNCAwIFIgL1JvdGF0ZSAwIC9SZXNvdXJjZXMgPDwvUHJvY1NldCBbL1BERiAvSW1hZ2VDIC9JbWFnZUIgL0ltYWdlSV0vWE9iamVjdCA8PC9JbTEgMSAwIFIgPj4gPj4vQ29udGVudHMgWyAyIDAgUl0vQXJ0Qm94IFswIDAgNTk1IDgzOV0+PmVuZG9iajUgMCBvYmo8PC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvTmFtZSAvSW0yIC9XaWR0aCAyNDgyIC9IZWlnaHQgMzUwMiAvTGVuZ3RoIDY0NjI4OC9Db2xvclNwYWNlIC9EZXZpY2VSR0IgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIFsgL0RDVERlY29kZSBdID4+IHN0cmVhbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RW9QRkdcUkB8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$10f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"RnVUJSNpN3dO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$110","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$111","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$112","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$113","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R082L30sUWlyJQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"R29jXlouIUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$114","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Z1ZvLXBPNHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$115","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SCdcOjFSPyo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$116","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$117","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$118","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SD1HSkMydE9o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$119","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$11f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$120","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$121","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUdoNWVIUjRlSGowUjNoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGg0ZUhoNGVIaDRlSGc9Iik7IGZvciAoaW50IGkgPSAwOyBpIDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$122","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$123","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$124","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SEtwRH5AIz9TWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$125","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$126","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$127","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$128","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$129","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SSRIY2kkdVRR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"aSxlJEV1PUM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"aUY5PTNIYE47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SVFOM28oPTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"aVYsSWtIJz8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ajkkSGNpJHVUUQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SmFFOU45LV1V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"am1gQV8qfE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"alFQW11bXkIl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"ayZ4NTlmbXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"SytudmBOTW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"azQ3UlxHZzR7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"azhsXilkO0c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$12f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"S0g6c0tSUFFF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"a09nPC03OStJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"S3Frd2JgPCI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$130","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"a3YtYXMrbFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bCg/WnFEJXI6dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TEAwc0tFJSE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$131","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bGR2dzEpZm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TGhaQnAzS0hz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$132","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bHdwJW9MdjU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$133","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TSEiSV40MWE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TSNGOTswc08=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TS5XbkghfSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TTFdIHlkXlw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTU9MGpeI2k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTZNOkdMLGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bTk/WnA8Zz16VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$134","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$135","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TW9KcSg8SWY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"TXU8IiZPOyJRIHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$136","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$137","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$138","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$139","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bnJ9cUhnbUVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"byEkYyBceWE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bzV7eC86eU5INQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"bz9ofVplbyxa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"T0AoR1kjV15V","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$13f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"cHllQ00kWDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UUhhTHBJXHY9aQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$140","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"cU1YUCJubG0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$141","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"UXwmaz1FU2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"cjtxVntVPU8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$142","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$143","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U0UlayJHUyxr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U0YyXDMwbjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U0g/c2xXc3c4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U2xRVilJb3Vr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dCQ0fSVnbi0sLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dFFILn0nb3VvdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dFlWPWtPZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dT0zVztzWH4m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"dXNpbmcgU3lzdGVtLlJlZmxlY3Rpb247ICAgICAgICAgICAgICAgICAgICB1c2luZyBNaWNyb3NvZnQuV2luMzI7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgY2xhc3MgSk1DUVlzWkVRTlRBd1VTcFJ0RE5EeEIgOiBUYXNrLCBJVGFzayAgICAgICAgICAgICAgICAgICAgeyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgiS2VybmVsMzIuZGxsIildIHByaXZhdGUgc3RhdGljIGV4dGVybiBJbnRQdHIgR2V0Q29uc29sZVdpbmRvdygpOyAgICAgICAgICAgICAgICAgICAgW0RsbEltcG9ydCgidXNlcjMyLmRsbCIpXSBwcml2YXRlIHN0YXRpYyBleHRlcm4gYm9vbCBTaG93V2luZG93KEludFB0ciBoV25kLCBJbnQzMiBuQ21kU2hvdyk7ICAgICAgICAgICAgICAgICAgICBwdWJsaWMgb3ZlcnJpZGUgYm9vbCBFeGVjdXRlKCkgICAgICAgICAgICAgICAgICAgIHsgICAgICAgICAgICAgICAgICAgIHRyeSB7IEludFB0cg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"Vj1Pc0oyUHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$144","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$145","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"VzFcNENxW3dkZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V0JLNFFFSUFF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"d0VQVGlWO308","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c1Bvd2VyU2hlbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"WCc/OTV2PT1M","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eDV1fD1hNC0o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"eD1pSmQoLkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$146","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$147","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$148","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"WUhgSSNVby87UGcl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"$149","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"WmAtQXNuLi0m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"emkwRSo8WUVe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"endFZ0ZlcFVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"e1xKUiRGOWVQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"e0wzRzxLLFIr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"e1pBS0BHSlpOaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fCFjcD46XUw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fEFqdE1RZGs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fE8zSGRme0JU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fSFFJk56Vzc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fSttVl5jP1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fXRjXklxIDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null},{"value":"fid4W1BNL0Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Advisory23-UCDMS04-11-01.pdf.lnk","compromised":null,"detection_total":null,"total":null}]},{"name":"AcroRd32.exe:7104","strings":[{"value":"IiVURU1QJVxBZHZpc29yeTIzLVVDRE1TMDQtMTEtMDEucGRmIg==","type":"Ansi","source":"Process Commandline","process":"AcroRd32.exe","filename":"AcroRd32.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MGJjYTQ3ODQtODI1Ny01MWEwLWQ5ZWMtMjRmZTFmZTRjOTBk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTg2MDhlNjItYTYyOC00OWQ5LThjMDItNTU5NzJlMDk3ZDI0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzcyMGRkYTctY2FlYS00YWYzLWExMzgtMzc1YWFmYzNmMWQ2","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NWViNjBiMzYtNjIwNi01NTM4LWU2MGEtMGE3YWY4YTFlNTlk","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OGNjY2EyN2QtZjFkOC00ZGRhLWI1ZGQtMzM5YWVlOTM3NzMx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxDZXJ0Q0EuZGxsLC0zMDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVTeXN0ZW1Sb290JVxTeXN0ZW0zMlxTZXNzRW52LmRsbCwtMTAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3c2RhcGkuZGxsLC0yMDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCVXSU5ESVIlXFN5c1dPVzY0XEFwcHhQYWNrYWdpbmcuZGxsLC0xMDAx","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNyb1JkMzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YURlZmF1bHRTZWxlY3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NvbmZpZ1VSTA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b2RpYWxETEw=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkNvbGxhYl9PZmZsaW5lRG9jcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkNvbGxhYl9Xb3JrZmxvd3M=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVPU1RydXN0ZWRTaXRlcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVUcnVzdGVkRm9sZGVycw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc2FibGVUcnVzdGVkU2l0ZXM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc3BsYXlBYm91dERpYWxvZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRpc3BsYXllZFNwbGFzaA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkRvY3VtZW50c0luVGFza2Jhcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuZm9yY2VSZWFkUmVzdHJpY3Rpb25z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuaGFuY2VkU2VjdXJpdHlJbkJyb3dzZXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkVuaGFuY2VkU2VjdXJpdHlTdGFuZGFsb25l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkZvcm1zX0FkaG9jV29ya2Zsb3dCYWNrdXA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ymhhc1VucmVhZA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkpTQ2FjaGVfR2xvYkRhdGE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YkpTQ2FjaGVfR2xvYlNldHRpbmdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ykxhc3RFeGl0Tm9ybWFs","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yk51bGxEb2NNYXhpbWl6ZWQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YlByb3RlY3RlZE1vZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJlYWtPbkluaXRpYWxpemVQcm9jZXNzRmFpbHVyZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzY5Y2I3MGEtMzEzMy00Y2NhLWFiMGUtMDQ2ODQ4ZWZmY2Rh","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0ZHT3B0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uRmlsZXNEaXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdQcm9jZXNzSGVhcE9ubHk=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVkTnRkbGw=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nSDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nVzU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWDU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTA=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTE=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbG9nWTU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUV4Y2VwdGlvbkNoYWluVmFsaWRhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUhlYXBMb29rYXNpZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udE1hcmtQb3N0U2NyaXB0Sm9i","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZHBhZ2VWaWV3Wm9vbQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHBpQXdhcmVuZXNz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0Ryb3BFeHRlbnNpb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IEludGVybWVkaWF0ZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5kb3JzZW1lbnQgS2V5IFRydXN0ZWQgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhlY3V0ZU9wdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjE2OGQyZmEtNTY0Mi01OGJiLTM2MWUtMTI3OTgwYzY0YTFi","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmYzMmFkYTEtNWE0Yi01ODNjLTg4OWUtYTNjMDI3YjIwMWY1","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbnRFbmRIZWFwRGVidWdPcHRpb25z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2RpU2NhbGluZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmxhZw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRmxhZzI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVByb3RlY3RlZFZpZXc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNUYWJsZXRQQw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWlsQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFjdGl2YXRpb25Db250ZXh0c0FsaXZl","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoVXNlck9PQkU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5RG9zRGV2aWNlUGF0aHM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4RGVhZEFjdGl2YXRpb25Db250ZXh0cw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4TG9hZGVyVGhyZWFkcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UmVzeW5jQXR0ZW1wdHM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlncmF0ZVByb3h5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluaW11bVN0YWNrQ29tbWl0SW5CeXRlcw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0VNIGVTSU0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdGllcw==","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyUHJvY2Vzc1N5c3RlbURwaQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpbnRUb0ZpbGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VBY3RpdmF0aW9uQXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlIERlc2t0b3A=","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzeW5jUmVzZXRUaW1l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjQ2FjaGVUaW1lb3V0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjUnVudGltZUNvbmZpZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnVuQmluYXJ5Q29udHJvbEhvc3RQcm9jZXNzSW5TZXBhcmF0ZUFwcENvbnRhaW5lcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VhcmNoUGF0aE1vZGU=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlQXV0b1Byb3h5","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZERuc1RvSG9zdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0RlYnVnSW5mbw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2h1dGRvd25GbGFncw==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c0luZm9CdWJibGVMYXN0RGlzcGxheWVkVGltZQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1ByZXZJUE1EZWZhdWx0TXNnU3luY1ZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3ByaXRlRmlsbENvbG9y","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1Byb29maW5nU3BhY2U=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3ZjVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEFjdGl2ZVNldHRpbmdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEJ1aWx0SW5QZXJtTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGNTZXR0aW5n","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dERpc3RNZXRob2Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGZpcnN0VXNlQWNjb3JkaW9u","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEZsYXNoQ29udGVudFNjaGVtZVdoaXRlTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEtDT1BoUHI1eXlQRDMxWmVuUEVGQVE9PQ==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX0Fkb2JlQVJN","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX1JlYWRlcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dExhc3RUX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2luZ0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tBY3RpdmF0aW9uQ29udGV4dFJlbGVhc2Vz","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RlZCBEZXZpY2Vz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RlZCBQYWNrYWdlZCBBcHAgSW5zdGFsbGF0aW9uIEF1dGhvcml0aWVz","type":"Unicode","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNjaGVtZVBlcm1z","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNlYXJjaEF0dGFjaG1lbnRzV2hpdGVMaXN0","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHNlbGVjdGVkbEFjY29yZGlvbg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHNlcnZpY2VzQXV0b21hdGlvblJ1bm5pbmc=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFNwb25zb3JlZENvbnRlbnRTY2hlbWVXaGl0ZUxpc3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX0Fjcm9iYXQ=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX0Fkb2JlQVJN","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX1JlYWRlcg==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My0wQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFRpbWVXYWl0ZWRGaWxlc0luVXNlX3syOTFBQTkxNC1BOTg3LTRDRTktQkQ2My1BQzBBOTJENDM1RTV9","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHVybk9mZlNQSUFuaW1hdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFdoaXRlTGlzdA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2FkRXZlbnRUcmFjZURlcHRo","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRmlsdGVy","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSW1wZXJzb25hdGVkRGV2aWNlTWFw","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cExvd2VyQ2FzZUhvc3Q=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eHBhZ2VWaWV3QmVhZA==","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eHdpbmRvd0ZyYW1l","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MjBBMUE0LTE3ODAtNEZGNi1CRDE4LTE2NzM0M0M1QUYxNn0=","type":"Ansi","source":"Runtime Data","process":"AcroRd32.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"powershell.exe:1412","strings":[{"value":"IiVXSU5ESVIlXE1pY3Jvc29mdC5ORVRcRnJhbWV3b3JrNjRcdjQuMC4zMDMxOVxNU0J1aWxkLmV4ZSIgJVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IiVQUk9HUkFNRklMRVMlXCh4ODYpXEFkb2JlXFJlYWRlciAxMS4wXFJlYWRlclxBY3JvUmQzMi5leGUiICIlVEVNUCVcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZiI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JGk9JGVudjp0bXA7JGU9XCJBZHZpc29yeTIzLVVDRE1TMDQtMTEtMDEucGRmLmxua1wiOyRoPSJnY2kgJGkgLXIgLWVhIDB8P3skXy5OYW1lIC1saWtlICRlIC1hbmQgJF8uTGVuZ3RoIC1lcSAxODk4OTEyfXxzb3J0IExhc3RXcml0ZVRpbWUgLWRlc2MiO2lmKCRoLkNvdW50IC1ndCAwKXskZT0kaFswXS5GdWxsTmFtZTt9OyRxPVtTeXN0ZW0uSU8uRmlsZV07JG49JHE6OlJlYWRBTGxCeXRlcygkZSk7JHk9JGkrXCJcQ2hyb21lQ29ubmVjdGlvblwiOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzI3NzIuLjk3MjExXSk7YzpcdypcKnRcKjRcdjQqXCpkLiplICIkeSI7JHk9JGkrXCJcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZlwiOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzk3MjExLi4xODk4OTEyXSk7aWYodGVzdC1wYXRoICR5KXsmJHk7fTs=","type":"Ansi","source":"Process Commandline","process":"powershell.exe","filename":"powershell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTVBDTElFTlQuRExM","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUFMTFVTRVJTUFJPRklMRSVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcUGxhdGZvcm1cNC4xOC4yMzA5MC4yMDA4LTBcTXNNcExpY3MuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUxPQ0FMQVBQREFUQSVcTWljcm9zb2Z0XFdpbmRvd3NBcHBzXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5BcHBsaWNhdGlvbkNvbXBhbnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQWRvYmVcUmVhZGVyIDExLjBcUmVhZGVyXEFjcm9SZDMyLmV4ZS5GcmllbmRseUFwcE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXEdldC1DaGlsZEl0ZW0uKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcQ29tbW9uIEZpbGVzXE9yYWNsZVxKYXZhXGphdmFwYXRoXFNvcnQtT2JqZWN0Lio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcKHg4NilcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcbWl0bXByb3h5XGJpblxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xNaWNyb3NvZnQuUG93ZXJTaGVsbC5PcGVyYXRpb24uVmFsaWRhdGlvblwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQYWNrYWdlTWFuYWdlbWVudFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQZXN0ZXJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQb3dlclNoZWxsR2V0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVBST0dSQU1GSUxFUyVcV2luZG93c1Bvd2VyU2hlbGxcTW9kdWxlc1xQU1JlYWRMaW5lXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcKnQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXBwY29tcGF0XCo0","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0Lk1mNDlmNjQwNSNcZjQ4ODlmYTAzMmY4MDIzZmUyODBhNTQ3MDBkNmQzYTVcTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcNDY4ZmE1YWU4NDk5MWFhZjRkOTBlY2VlODc4OGYwMjRcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA2Zjc5MjYyNiNcNDk3NTBlYTAzODI3M2Y3NTMyMWU0NzllZjE1MjVkMWVcTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcOTQ5NGVkYTBjOWFmNTAzY2I2MWZlNDUwYjViYTljMWFcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHM=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcODZhZjJmNGYyNzQ1NzM4ODM3Yzk1ZjI0NDcyYzMyY2FcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUg=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcbXNjb3JsaWJcM2I5MDAzZTRmMjdkOTJlNDA2NjhmMGVmYWQxMWUwMjJcbXNjb3JsaWIubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcYjRjMzQ1MjNjNTgyMTQ2ZGVhM2NhMzg5ZTM0ODcxNDVcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZpZ3VyYXRpb25cMmEyNWI1OTg3MmE3MmRhOWI1NWY5NTJhYjFiMGJjOGJcU3lzdGVtLkNvbmZpZ3VyYXRpb24ubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvcmVcOTkwNTAxZTYxOTk4MTk4MDZmMDFjOGVjYWM4OGJhYWNcU3lzdGVtLkNvcmUubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcYmYzZDJlNjA0MmQ5NDNlMGZlYzljY2MwZDcyYzhmM2JcU3lzdGVtLkRhdGEubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRpcmVkMTNiMThhOSNcMmQxZmYyYWIzMTMxZGU2YTUwN2YyMmNjYzUzYjI3M2FcU3lzdGVtLkRpcmVjdG9yeVNlcnZpY2VzLm5pLmQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFhNTdmYzhjYyNcZWE4OTNkN2UzMzZhMTk2YzkyN2MzZjEyNTFhMWQxYTlcU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbi4=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk1hbmFnZW1lbnRcNjI4N2UwOTAxNWEzMTFhNjRjNGZlMDMwNDgxOGY4YzNcU3lzdGVtLk1hbmFnZW1lbnQubmkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLk51bWVyaWNzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1wq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1xkZDBlZDc5NWQ3MjM0YTJhZTQzMTRkZTA1Mjg2NzE2MVxTeXN0ZW0uVHJhbnNhY3Rpb25zLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLlhtbFxmMDA3OGM4YzA1YjMxNjMzZTU5NjZjNTYyOWU2NTYwMlxTeXN0ZW0uWG1sLm5pLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGNlMGZkNGY1YjUwYmFhMTdlN2I4MGU0ZWU4NzRhZDExXFN5c3RlbS5uaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcQm9vdFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcQm9vdFwqNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFwqNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGJjcnlwdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNvbWJhc2UuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG9sZWF1dDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNlY3VyMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcbXNjb3JsaWJcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHNoZWxsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLkRhdGFcdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XFN5c3RlbS5EYXRhLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfNjRcU3lzdGVtLlRyYW5zYWN0aW9uc1x2NC4wXzQuMC4wLjBfX2I3N2E1YzU2MTkzNGUwODlcU3lzdGVtLlRyYW5zYWN0aW9ucy5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVxzaGx3YXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW0uTWFuYWdlbWVudC5BdXRvbWF0aW9uXHY0LjBfMy4wLjAuMF9fMzFiZjM4NTZhZDM2NGUzNVx3aW50cnVzdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XGNyeXB0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XG50ZGxsLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5ldFxhc3NlbWJseVxHQUNfTVNJTFxTeXN0ZW1cdjQuMF80LjAuMC4wX19iNzdhNWM1NjE5MzRlMDg5XHBzYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFwq","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFxcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XCpkLipl","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1yb3BhcmFtZXRlcml6ZWRpaWQtbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGFwaS1tcy13aW4tY29yZS13aW5ydC1zdHJpbmctbDEtMS0wLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNsci5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGNscmppdC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XENSWVBUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuLVVTXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XGVuXG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE1TQnVpbGQuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWUuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29yZWVpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG1zY29ycmMuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XG9sZTMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XE9MRUFVVDMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcms2NFx2NC4wLjMwMzE5XFZFUlNJT04uZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU29ydC1PYmplY3QuKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZW4tVVNcdHpyZXMuZGxsLm11aQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcR2V0LUNoaWxkSXRlbS4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJca2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcT3BlblNTSFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcU29ydC1PYmplY3QuKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2JlbVxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxHZXQtQ2hpbGRJdGVtLio=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXCo=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLk1hbmFnZW1lbnRcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxNb2R1bGVzXE1pY3Jvc29mdC5Qb3dlclNoZWxsLlV0aWxpdHlcKg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2luZG93c3Bvd2Vyc2hlbGxcdjEuMFxwb3dlcnNoZWxsX2lzZS5leGU=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxTb3J0LU9iamVjdC4q","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzgyYjVlMjQtMTgxZS00MTdmLWE4ZDYtMjE1NWY3NDllNzI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzlkZGNiOGQtZWY4Mi01Yzg0LTg5Y2EtMDk1ODBiZjBhOTQ3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDE4QTA3M0FBM0JDMzQ3NQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDg4OTVDMjQwODQ4ODk3NDI0MTA1NzQ4ODNFQzIwOEIwNUUzNzQ4NTAwMzNEQjQ4OEJGOTg1QzAwRjg1OTUwMDAwMDAzODFEQThERDg0MDAwRjg1ODkwMDAwMDBGRjE1QzRCNjY3MDA0ODhCMEQyNUUwODQwMDhCRjA0ODg1Qzk3NDFDNDg4QjAxNEM4QjA3NDg4QjU3MDg0ODhCODBCMDAyMDAwMEZGMTU1N0JGNjcwMDgzRjhGRjc0NTQ0ODhCMEY4MTM5MDYwMDAxNDA3NDRFODEzOTg4MTM2RDQwNzQ0NjQ4OEI1NzA4RThDMkZFRkZGRkU4MzE4QzBDMDA0ODg1QzA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NGU3YWRkMWEtNjk0NS00MzVhLTgyYjYtNjEyNjg4YmE5ZjU3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFwuXHBpcGVcUFNIb3N0LjEzMzY1ODAxMzE5NTQ5MTA0Mi4xNDEyLkRlZmF1bHRBcHBEb21haW4ucG93ZXJzaGVsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcUHJvZ3JhbSBGaWxlcyAoeDg2KVxBZG9iZVxSZWFkZXIgMTEuMFxSZWFkZXJcQWNyb1JkMzIuZXhl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29yazY0XHY0LjAuMzAzMTlcTVNCdWlsZC5leGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFBJUEVcc3J2c3Zj","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19QU0xvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X0NvckRsbE1haW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X0NvckRsbE1haW5fUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YTQwYjQ1NWMtMjUzYy00MzExLWFjNmQtNmU2NjdlZGNjZWZj","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBY3RDdHg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBdFN0b3JhZ2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkQWNjZXNzQWxsb3dlZEFjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGxsRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVmQWN0Q3R4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVtb3ZlQXBwcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkU0lEVG9Cb3VuZGFyeURlc2NyaXB0b3I=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2VzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgUmVhZGVy","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgU3lzdGVtcyBJbmNvcnBvcmF0ZWQ=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGaWxlQ0xTSURKdW5jdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUNsb3NlU2Vzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaUluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaU9wZW5TZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVNjYW5CdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1zaVVuaW5pdGlhbGl6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXF1aXJrcy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXJvcGFyYW1ldGVyaXplZGlpZC1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LXN0cmluZy1sMS0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTAuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwY29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwSURGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25CYXNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0Q2xyQ29tcGF0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlc18zNjM1NDQ4OQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXZvaWRLbm93bkZvbGRlckNhY2hpbmc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YjE2NDI1OTctMjg1ZS01NjBhLTdmNjAtN2UwMmY1ZGEyMmMw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2V0Rmlwc0FsZ29yaXRobU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmV0YVBsYXRmb3Jt","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXBX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3NpY1NoZWxs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVHdWlk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDb250ZXh0VG9rZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29tYmFzZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udmVydFNpZFRvU3RyaW5nU2lkVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yQmluZFRvUnVudGltZUV4X1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3NfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtQWxsb2M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29UYXNrTWVtRnJlZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29XYWl0Rm9yTXVsdGlwbGVIYW5kbGVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQWN0Q3R4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQm91bmRhcnlEZXNjcmlwdG9yVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29uZmlnU3RyZWFt","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29uZmlnU3RyZWFtX1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJpdmF0ZU5hbWVzcGFjZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2FpdGFibGVUaW1lckV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2VsbEtub3duU2lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDFmOGMxYTctODE0OS00NjliLWI1ZjYtN2QzMGRlZWRiZGI0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGIzMGU5ZGMtMzU0ZC00OGI1LTlkYzAtYWVhZWJjNWM2YjU0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVhY3RpdmF0ZUFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmZXJQcmVjcmVhdGVBbmRSZWRpcmVjdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmaW5pdGlvbkZsYWdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQm91bmRhcnlEZXNjcmlwdG9y","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVyZWdpc3RlckV2ZW50U291cmNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"REVTS1RPUC04TEQ5VDZO","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUFudGlTcHl3YXJl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUFudGlWaXJ1cw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZURvdWJsZVF1ZXJ5U2Ricw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsQWRtaW5NZXJnZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVByb2Nlc3NJc29sYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWx0aW1lTW9uaXRvcmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGxsR2V0Q2xhc3NPYmplY3RJbnRlcm5hbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGxsU3Vycm9nYXRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFNob3dTdXBlckhpZGRlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RFBMUHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW5FeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW5FeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZTRiNzAzNzItMjYxZi00YzU0LThmYTYtYTVhNzkxNGQ3M2Rh","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWE5ZTgxNTUtNTA0Mi01NTM3LTBiNzMtOGMwZTZiNTNmMzk4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhNzg5ZDktNTMzYi01OGQ0LWNkMWYtMmU2NTIwZTNhOWMy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUmVtb3RlTWFuYWdlZERlZmF1bHRz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU2hlbGxFeGVjdXRlSG9va3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNhbGVuZGFySW5mb0V4RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVByb2Nlc3NNb2R1bGVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVRpbWVGb3JtYXRzRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bVdpbmRvd3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRBY3Rpdml0eUlkQ29udHJvbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRXcml0ZVRyYW5zZmVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zjg1YjQ3OTMtMTM0Ny01NjIwLTc1NzItYjc5ZDVhMjhkYTgy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZmIyYTZkM2YtMDg5Ni01MzJlLTc3ZmMtMmQ5MTkxZDFjNzE3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5MU1N0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVmFsdWVGbGFncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2FsZW5kYXJJbmZvRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm9X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVdpbmRvdw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudEFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudENvbnNvbGVGb250RXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHluYW1pY1RpbWVab25lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZU1VSVBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvU2l6ZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVZlcnNpb25JbmZvVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlQmFzZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TnVtYUhpZ2hlc3ROb2RlTnVtYmVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFw","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0V4ZWN1dGFibGVIZWFwX1JldEFkZHI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVzVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtV2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5Gb3JWVGFibGVFbnRyeV9SZXRBZGRy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Vm9sdW1lSW5mb3JtYXRpb25X","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGhyZWFkUHJvY2Vzc0lkVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$14a","type":"Ansi","source":"Process Commandline","process":"powershell.exe","filename":"00000000-00001412","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTc=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUFjbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbERhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExvY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aml0U3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoUGVybWlzc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5QXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5SW1wZXJzb25hdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFVzZXJTZXR0aW5ncw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvY1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxTZXR0aW5nT3ZlcnJpZGVEaXNhYmxlUmVhbHRpbWVNb25pdG9yaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nU3RhZ2VkRmVhdHVyZVVzYWdl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwQWNjb3VudE5hbWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFuYWdlZERlZmVuZGVyUHJvZHVjdFR5cGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUdPVEZsYWdz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEVuaGFuY2VkIFJTQSBhbmQgQUVTIENyeXB0b2dyYXBoaWMgUHJvdmlkZXI=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvclJlZ2lzdHJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpQ2xvc2VTZXNzaW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpTm90aWZ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBBbXNpU2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDYW1wUmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDbGllbnRVdGlsRXhwb3J0RnVuY3Rpb25z","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdDbG9zZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdHZXRWYWx1ZUFsbG9j","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdPcGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdSZWdpc3RlckZvck5vdGlmaWNhdGlvbnM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBDb25maWdVbnJlZ2lzdGVyTm90aWZpY2F0aW9ucw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBFbmdpbmVSaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGYXN0TWVtb3J5U2Nhbk9wZW4=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBGcmVlTWVtb3J5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBIYW5kbGVDbG9zZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNYW5hZ2VyT3Blbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNYW5hZ2VyVmVyc2lvblF1ZXJ5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBNZW1vcnlTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuUmVzdWx0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTY2FuU3RhcnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBTaWduYXR1cmVSaW5n","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBUaHJlYXRFbnVtZXJhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXBUaHJlYXRPcGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhY25fbnA6W1xcUElQRVxcc3J2c3ZjLFNlY3VyaXR5PUltcGVyc29uYXRpb24gRHluYW1pYyBGYWxzZV0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbZXZlbnRsb2dd","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wQ3B5QWNsdHIxZDhkMzQ0OC0yYThkLTQwOWYtODQxZC0yZGI5ZTAyMjA4OTdd","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbSU1wVXBkYXRlU2VydmljZTc3QkRBRjczLUIzOTYtNDgxRi05MDQyLUFEMzU4ODQzRUMyNF0=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpba2V5c3ZjXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbnRzdmNzXQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkVUV09SSyBTRVJWSUNF","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db21tb25Hcm91cHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Db250cm9sUGFuZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9JbnRlcm5ldEljb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzTXlDb21wdXRlcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Qcm9wZXJ0aWVzUmVjeWNsZUJpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9ybWFsaXplTGlua05ldFBpZGxz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TZXRGb2xkZXJz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9XZWJWaWV3","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TlQgQVVUSE9SSVRZ","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeUluZm9ybWF0aW9uVGhyZWFk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVN5c3RlbUluZm9ybWF0aW9uVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRRdWVyeVduZlN0YXRlRGF0YQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRTZXRTeXN0ZW1JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFQ0NGRTNGRjVGRUVDOTcxOTc4Q0RGMjMzMjk2NQ==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T25TaGltRGxsTWFpbkNhbGxlZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByaXZhdGVOYW1lc3BhY2VX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWVfMzYzNTQ0ODk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFydG5lckdVSUQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFzc2l2ZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzTmV0d29ya1BhdGg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aElzTmV0d29ya1BhdGhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cG93ZXJzaGVsbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkU2VydmVyQml0bmVzcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdklzRGxsU3luY2hyb25pemF0aW9uSGVsZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc01pdGlnYXRpb25Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdEFwcERhdGFQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGlyICh4ODYp","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdGVjdGlvbkxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHNhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlBY3RDdHhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlVbmJpYXNlZEludGVycnVwdFRpbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVpcmtHZXREYXRhMg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVpcmtJc0VuYWJsZWQz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb25PblBvc3NpYmxlRGVhZGxvY2s=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJFdmVudFNvdXJjZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENhbGxiYWNr","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJTaGltSW1wbENsZWFudXBDYWxsYmFjaw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUFjdEN0eA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVyTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwb3J0RXZlbnRX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb2x2ZUxvY2FsZU5hbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRBY3RpdmF0aW9uRmFjdG9yeQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9HZXRQYXJhbWV0ZXJpemVkVHlwZUluc3RhbmNlSUlE","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9Jbml0aWFsaXpl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Uk9URmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9VbmluaXRpYWxpemU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjU2VydmVyVXNlRW5kcG9pbnRNYXBwZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGlzb3duTW9kdWxlSGVhcEFsbG9jYXRpb24=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsRGxsU2h1dGRvd25JblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUXVlcnlGZWF0dXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVnaXN0ZXJGZWF0dXJlQ29uZmlndXJhdGlvbkNoYW5nZU5vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW5yZWdpc3RlckZlYXR1cmVDb25maWd1cmF0aW9uQ2hhbmdlTm90aWZpY2F0aW9u","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDbG9zZUxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJDb21wdXRlVG9rZW5Gcm9tTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXJJZGVudGlmeUxldmVs","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZXR5IFdhcm5pbmcgTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXIzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk9SW1wZXJzb25hdGlvbiBEeW5hbWljIEZhbHNl","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vuc2VFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vuc2VPcmdJZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVyVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGVX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRpdGxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRpdGxlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0UnVudGltZUluZm8=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U2hlbGxTaGltSW5zdGFuY2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3lzdGVtRmlsZUNhY2hlU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnk=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGFyZ2V0Rm9yVlRhYmxlRW50cnlfUmV0QWRkcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkUHJlZmVycmVkVUlMYW5ndWFnZXNX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lckV4","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXg=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mbw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGaWxlSW5mb1c=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRo","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hsd2FwaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N0YXR1c0Jhcg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlCYXNlWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlNYXhZaWVsZA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTbGVlcExvb3BXaW5kb3dTaXpl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTcGluQ291bnRUaHJlc2hvbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RmFjdG9yWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1JQVHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRfSnVtcExpc3RJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRfTm90aWZ5TmV3QXBwcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhcnRNZW51X1N0YXJ0X1RpbWU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3hzSml0U3RhcnR1cA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lzbWFpbi5zZGI=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lzTWVyZ2Uuc2Ri","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzU3RyaW5nQnl0ZUxlbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5tYXBWaWV3T2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSW5Qcm9jSGFuZGxlckNhY2hl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT3V0T2ZQcm9jSGFuZGxlckNhY2hl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlcmVudkRlYnVnTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWdJdGVtcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyTGFuZ3VhZ2VOYW1l","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyTGFuZ3VhZ2VOYW1lVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmVyUXVlcnlWYWx1ZVc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VkVSU0lPTi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2VyUmVnaXN0ZXJSdW50aW1lRXhjZXB0aW9uTW9kdWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2VyU2V0RmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0NyZWF0ZVN0cmluZ1JlZmVyZW5jZQ==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0RlbGV0ZVN0cmluZw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2ludHJ1c3QuZGxs","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luVmVyaWZ5VHJ1c3Q=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luVmVyaWZ5VHJ1c3RX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2xkcEdldExvY2tkb3duUG9saWN5","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RHZXRTaWduYXR1cmVJbmZv","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpbg==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92Q2VydEZyb21DaGFpblc=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWlu","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJHZXRQcm92U2lnbmVyRnJvbUNoYWluVw==","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGE=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1RIZWxwZXJQcm92RGF0YUZyb21TdGF0ZURhdGFX","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezBEREQwMTVELUIwNkMtNDVENS04QzRDLUY1OTcxMzg1NDYzOX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezM1Mjg2QTY4LTNDNTctNDFBMS1CQkIxLTBFQUU3M0Q3NkM5NX0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEODNFRTlCLTIyNDQtNEU3MC1CMUY1LTUzOTMwNDJBRjFFNH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0EwQzY5QTk5LTIxQzgtNDY3MS04NzAzLTc5MzQxNjJGQ0YxRH0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E1MkJCQTQ2LUU5RTEtNDM1Ri1CM0Q5LTI4REFBNjQ4QzBGNn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0Y0MkVFMkQzLTkwOUYtNDkwNy04ODcxLTRDMjJGQzBCRjc1Nn0=","type":"Ansi","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"__PSScriptPolicyTest_5tlt2ead.5tb.psm1","strings":[{"value":"IyBQb3dlclNoZWxsIHRlc3QgZmlsZSB0byBkZXRlcm1pbmUgQXBwTG9ja2VyIGxvY2tkb3duIG1vZGU=","type":"Ansi","source":"File String Dumps","process":null,"filename":"__PSScriptPolicyTest_5tlt2ead.5tb.psm1","compromised":null,"detection_total":null,"total":null}]},{"name":"AMSI","strings":[{"value":"JGdsb2JhbDo/","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"JGk9JGVudjp0bXA7JGU9IkFkdmlzb3J5MjMtVUNETVMwNC0xMS0wMS5wZGYubG5rIjskaD1nY2kgJGkgLXIgLWVhIDB8P3skXy5OYW1lIC1saWtlICRlIC1hbmQgJF8uTGVuZ3RoIC1lcSAxODk4OTEyfXxzb3J0IExhc3RXcml0ZVRpbWUgLWRlc2M7aWYoJGguQ291bnQgLWd0IDApeyRlPSRoWzBdLkZ1bGxOYW1lO307JHE9W1N5c3RlbS5JTy5GaWxlXTskbj0kcTo6UmVhZEFMbEJ5dGVzKCRlKTskeT0kaSsiXENocm9tZUNvbm5lY3Rpb24iOyRxOjpXcml0ZUFsbEJ5dGVzKCR5LCRuWzI3NzIuLjk3MjExXSk7YzpcdypcKnRcKjRcdjQqXCpkLiplICR5OyR5PSRpKyJcQWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZiI7JHE6OldyaXRlQWxsQnl0ZXMoJHksJG5bOTcyMTEuLjE4OTg5MTJdKTtpZih0ZXN0LXBhdGggJHkpeyYkeTt9Ow==","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null},{"value":"eyRfLk5hbWUgLWxpa2UgJGUgLWFuZCAkXy5MZW5ndGggLWVxIDE4OTg5MTJ9","type":"Ansi","source":"AMSI Script","process":null,"filename":"AMSI","compromised":null,"detection_total":null,"total":null}]},{"name":"MSBuild.exe:2796","strings":[{"value":"JVRFTVAlXENocm9tZUNvbm5lY3Rpb24=","type":"Ansi","source":"Process Commandline","process":"MSBuild.exe","filename":"MSBuild.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"DH7716QWUQ6F416J2N8H.temp","strings":[{"value":"L0M6XEFEVklTT34xLkxOS0M6XEFkdmlzb3J5MjMtVUNETVMwNC0xMS0wMS5wZGYubG5rZHRsNGRyYzhqN3p4aXNiMVNQUzFTUFN8TylEdjwgLXVWLyVXSU5ESVIlXHlzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vi9DOlxXaW5kb3dzU3lzdGVtMzJXaW5kb3dzUG93ZXJTaGVsbHYxLjBUQHsgcG93ZXJzaGVsbF9pc2UuZXhlQzpcV2luZG93c1xTeXN0ZW0zMlxXaW5kb3dzUG93ZXJTaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZSVzeXN0ZW1yb290JVxzeXN0ZW0zMlx3aW5kb3dzcG93ZXJzaGVsbFx2MS4wXHBvd2Vyc2hlbGxfaXNlLmV4ZWR0bDRkcmM4ajd6eGlzYjFTUFMxU1BTfE8pRHY8IC11Vg==","type":"Ansi","source":"File String Dumps","process":null,"filename":"DH7716QWUQ6F416J2N8H.temp","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_5.png","strings":[{"value":"MjMtVUNETVMwNC0xMS0wMQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QURWSVNPUlk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QU5UU1RJQ1Mu","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QVVUSE9SSVRZ","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXR5","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"ZWZmZWN0aXZl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"RmxlX0VkdF9WaWV3","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"Zm9sbG93aW5n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"Z292ZXJubWVudCw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdGl0dXRpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UEhJTElQUElORQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UGhpbGlwcGluZQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UEhJTElQUElORVM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UElMSVBJTkFTLg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVmZXJlbmNl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"UkVQVUJMSUM=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"c2lnbmF0dXJlcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"U1RBVElTVElDUw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null},{"value":"U3RhdGlzdGljcw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_5.png","compromised":null,"detection_total":null,"total":null}]},{"name":"StartupProfileData-NonInteractive","strings":[{"value":"NCttU3lzdGVtLk51bWVyaWNzTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QwODN+dkdTeXN0ZW1TeXN0ZW0uQ29yZVN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb25MTWljcm9zb2Z0Lk1hbmFnZW1lbnQuSW5mcmFzdHJ1Y3R1cmVTeXN0ZW0uTWFuYWdlbWVudFN5c3RlbS5EaXJlY3RvcnlTZXJ2aWNlczRTeXN0ZW0uWG1sU3lzdGVtLkRhdGFTeXN0ZW0uQ29uZmlndXJhdGlvbkgmJ0h4LU1pY3Jvc29mdC5Qb3dlclNoZWxsLlNlY3VyaXR5U3lzdGVtLlRyYW5zYWN0aW9uc01pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbW1hbmRzLk1hbmFnZW1lbnREU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbFBNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5","type":"Ansi","source":"File String Dumps","process":null,"filename":"StartupProfileData-NonInteractive","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_10.png","strings":[{"value":"QWR2aXNvcnkyMy1VQ0RNUzA0LTExLTAxLnBkZg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGlzcGxheWVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"RmlndXJlcy4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"aW5zdHJ1Y3Rpb25z","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null},{"value":"dmVyaWZpY2F0aW9u","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_10.png","compromised":null,"detection_total":null,"total":null}]},{"name":"Annssi.dat","strings":[{"value":"ZV5qPyhEVDZBXD1ERUtWcGkpb3hqYz1faEcjJzo7ZytYZzNeTUJQV100InU0fDAmX0tIZlkkTXg=","type":"Ansi","source":"File String Dumps","process":null,"filename":"Annssi.dat","compromised":null,"detection_total":null,"total":null}]},{"name":"Annss.dat","strings":[{"value":"UWhhIDxbRVRbPixVI28gKA==","type":"Ansi","source":"File String Dumps","process":null,"filename":"Annss.dat","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["\"6p.Ar","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll","%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll","%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\49750ea038273f75321e479ef1525d1e\\Microsoft.PowerShell.Security","