24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 5de68fd5147c… — Score 100/100 — Sample 70cb1a8cb425…","description":"Malicious verdict for sandbox report 5de68fd5147c…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 54 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6/5de68fd5147c6120bb7d5d0c","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6"],"about":{"@type":"SoftwareApplication","name":"Ricks75.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 7 64 bit","behavioralIndicators":{"malicious":10,"suspicious":19,"totalSignatures":54},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==26:Taa8,"" touched "Copy/Move/Rename/Delete/Link Object" (Path: "HKCU\WOW6432NODE\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}") "" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON") "" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "" touched "Memory Mapped Cache Mgr" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}")27:T68a,Process "vssadmin.exe" (UID: 00025650-00001304) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "vssadmin.exe" (UID: 00025650-00001304) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "vssadmin.exe" (UID: 00025713-00003488) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "vssadmin.exe" (UID: 00025713-00003488) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WMIC.exe" (UID: 00025853-00003052) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WMIC.exe" (UID: 00025853-00003052) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "bcdedit.exe" (UID: 00025859-00001892) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "bcdedit.exe" (UID: 00025859-00001892) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "bcdedit.exe" (UID: 00026262-00002348) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "bcdedit.exe" (UID: 00026262-00002348) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00034246-00004680) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00034246-00004680) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"28:T4f1,"" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\SysWOW64\ieframe.dll" "" touched file "C:\Windows\SysWOW64\en-US\ieframe.dll.mui" "" touched file "C:\Windows\System32" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\cmd.exe" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\SysWOW64\en-US\setupapi.dll.mui" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui"29:T457,"All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: abcd-help@countermail.com Be sure to duplicate your message on the e-mail: supportpc@cock.li Your personal id:" (Source: Ricks75.exe.bin, Indicator: "decrypt your files") "All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can dec" (Source: 00025321-00001596-00000005-20784608717, Indicator: "files are encrypted")2a:T64d,"" opened "C:\Program Files\7-Zip\7zCon.sfx" with delete access "" opened "C:\Program Files\7-Zip\descript.ion" with delete access "" opened "C:\Program Files\7-Zip\7z.sfx" with delete access "" opened "C:\Program Files\7-Zip\History.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\af.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\an.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\ar.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\az.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\ba.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\be.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\cy.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\el.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\eo.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\es.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\cs.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\et.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\eu.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\fa.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\fr.txt" with delete access "" opened "C:\Program Files\7-Zip\Lang\fur.txt" with delete access2b:T990,"" wrote bytes "d83a2f75" to virtual address "0x75300274" (part of module "SSPICLI.DLL") "" wrote bytes "c0dfa5771cf9a477ccf8a4770d64a67700000000c011467500000000fc3e467500000000e0134675000000009457547725e0a577c6e0a57700000000bc6a537700000000cf3146750000000093195477000000002c32467500000000" to virtual address "0x76251000" (part of module "NSI.DLL") "" wrote bytes "0efca87781eda777ae86a677c6e0a577effda8772d16a777c0fca477da8faf776014a977478da677a8e2a5776089a67700000000ad37d8758b2dd875b641d87500000000" to virtual address "0x73851000" (part of module "WSHIP6.DLL") "" wrote bytes "b4360200" to virtual address "0x752F4D68" (part of module "SSPICLI.DLL") "" wrote bytes "d83a2f75" to virtual address "0x75300258" (part of module "SSPICLI.DLL") "" wrote bytes "b4362f75" to virtual address "0x75300278" (part of module "SSPICLI.DLL") "" wrote bytes "b4360200" to virtual address "0x752F4EA4" (part of module "SSPICLI.DLL") "" wrote bytes "b4362f75" to virtual address "0x7530025C" (part of module "SSPICLI.DLL") "" wrote bytes "d83a2f75" to virtual address "0x753001FC" (part of module "SSPICLI.DLL") "" wrote bytes "d83a2f75" to virtual address "0x753001E0" (part of module "SSPICLI.DLL") "" wrote bytes "b4362f75" to virtual address "0x75300200" (part of module "SSPICLI.DLL") "" wrote bytes "b83012a373ffe0" to virtual address "0x75D81368" (part of module "WS2_32.DLL") "" wrote bytes "6012a373" to virtual address "0x73F94028" (part of module "WEBIO.DLL") "" wrote bytes "6012a373" to virtual address "0x7616E324" (part of module "WININET.DLL") "" wrote bytes "b4362f75" to virtual address "0x753001E4" (part of module "SSPICLI.DLL") "" wrote bytes "711139027a3b3802ab8b02007f950200fc8c0200729602006cc805001ecd35027d263502" to virtual address "0x757207E4" (part of module "USER32.DLL") "" wrote bytes "b84013a373ffe0" to virtual address "0x752F3AD8" (part of module "SSPICLI.DLL") "" wrote bytes "d83a0200" to virtual address "0x752F4E38" (part of module "SSPICLI.DLL") "" wrote bytes "d83a0200" to virtual address "0x752F4D78" (part of module "SSPICLI.DLL") "" wrote bytes "68130000" to virtual address "0x75D81680" (part of module "WS2_32.DLL")2c:T7df,"" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 2408) "" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 2408) "" wrote 4 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 2408) "" wrote 8 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 2408) "" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 400) "" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 400) "" wrote 4 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 400) "" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 400) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\PING.EXE" (Handle: 132)2d:T67d,Found malicious artifacts related to "88.99.66.31": ... URL: http://iplogger.org/ (AV positives: 3/72 scanned on 12/03/2019 13:19:04) URL: https://2no.co/20SBp.png (AV positives: 2/72 scanned on 12/03/2019 00:58:56) URL: http://iplogger.org/1ax3r7 (AV positives: 3/71 scanned on 12/03/2019 05:21:42) URL: https://2no.co/2kjcf5.zip (AV positives: 3/72 scanned on 12/03/2019 08:41:33) URL: https://yip.su/2A2yA5 (AV positives: 4/71 scanned on 12/02/2019 21:10:22) File SHA256: 25c60987a0148c19477196257478f14c584600acd742369cb8859256ff005400 (Date: 12/02/2019 19:44:27) File SHA256: 54a32aca91c9e377199ac9741b224d5ee09dc4ac67f6177bb4e9f336e5d178b2 (Date: 12/02/2019 10:09:35) File SHA256: 284fca96f27a66ed051896d2d4e4d4223bf13cb78f9ac93e4485690f552466f9 (Date: 12/02/2019 08:27:27) File SHA256: 3080858d67dfa757fd27fa4dc3cfd521a8308b8698eeec6fb599fefd7903ef76 (Date: 12/01/2019 12:30:24) File SHA256: bf91a306b6ab0b0c3aa967a3d75d695cd17f4657f79d701fae635a2b1370fea1 (Date: 12/01/2019 12:20:56) File SHA256: b21eee65a4989045031d505f4815480af360fef439d3c8a33b4e25b2bae6417f (AV positives: 10/67 scanned on 11/27/2019 12:54:22) File SHA256: 45ccc6cbb985349ce634514adbb78f40ea9c6ad254fb66a85d135d88b9ba6699 (AV positives: 8/73 scanned on 11/18/2019 13:08:15) File SHA256: 973b0b17d797cff3efc339ada398171f17b694ca23ad142daabc2d3f0fa2a7e5 (AV positives: 17/72 scanned on 11/12/2019 11:12:13) File SHA256: 776bc011b5cb042decafe43f2b584b0afe9da5c7b9d9ac6de81e885a7defbeaf (AV positives: 28/73 scanned on 11/10/2019 08:31:29) File SHA256: f6c5022df4d05e6440f8157eec277cd1908a2f7f3dfb4ccce99994d4d273ff1e (AV positives: 34/74 scanned on 11/07/2019 20:08:18)2e:T44f,Spawned process "" (UID: 00025321-00001596) Spawned process "cmd.exe" with commandline "/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" (UID: 00025643-00001776) Spawned process "vssadmin.exe" with commandline "vssadmin delete shadows /all /quiet" (UID: 00025650-00001304) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00025713-00003488) Spawned process "WMIC.exe" with commandline "wmic shadowcopy delete" (UID: 00025853-00003052) Spawned process "bcdedit.exe" with commandline "/set {default} recoveryenabled No" (UID: 00025859-00001892) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00026262-00002348) Spawned process "cmd.exe" with commandline "/C ping 1.1.1.1 -n 20 > Nul & Del /f /q "C:\Ricks75.exe"" (UID: 00034246-00004680) Spawned process "PING.EXE" with commandline "ping 1.1.1.1 -n 20" (UID: 00034335-00004720)2f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:Tbff4,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uy9fahf5b3mfRMcEXEckUwJnSDinDl0pJTiKWc6nUE6nZlDxzlzKDIcejqdTkfO8Xg8rVprre8aYzQxxvfXqrW+xBhjTK2nE6R0WhFxxJEiIiIdKSIiIiJBikgQH5/TZ/rc12ft/V2/tfdOspN8Lq4/dvZa6173utfa2dcnv9/vSmtLp3PPDbf2pfRT6efSW9LQvenf9j7ssNb75JPDg2P/rPdLL7Xeg2OXTsema61ITzr2oBOeq/1Qf/3XC/epp4bPPjt83nnha64J3313+KGHwg8/HL799vAtt4Svvjp81VXhyy+vfOml4TVrwvhr5ayzwn/5l+F/+2/DX/lK+D/8h/CXvhT+F/8i/C//ZfiP/ij8mc+E//k/D//TfxpetSp8xBHhf/yPw4cfHv5H/yj8T/5J+LjjKn/uc+F//a/D/+bfhP/Vvwr/2Z+F//2/D2PpYJz3+OPD/+yfhbFWK1eGsRr/4B+El06/XDod8H/hXlbqo//V9P/vHTuWoQ0NSgk5Qo6QI+QIOUKOkCPkCDlCjlJCjpAj5Ag5Qo6QI+QIOUKOFnKUEnKEHCFHyBFyhBwhR8gRcoQcIUcpIUfIUUKOkCPkCDlCjpAj5Ag5SqllLISTDRvCSH2vvx7euDGMobBz+yi8a1e4jkxtVbqt6Y0TgTxxCa09Hc5ZtXZD7/oC22HpnBV3TmGSg52/3Pu991rvn/40/M474dauCx/ZwivTasH6h/8wvHp1+IQTwv/xP4a/8Y0waArYdu+94XvuCT/wQPhHPwpff3342mvD110XvvHG8K23hn/4wzDOu21b+Mc/Dj/ySBgQi6Gw9cEHw9h5y5YwaPm++8K4hLvuCv/gB2Gs5ObNYUwDW2HcwTvvDKt9of+j1P+VPw5KCTlCjpCjhBwhR8gRcpSQo5QScoQcIUfIEXKEHCFHyFFCjlJKyBFyhBwhR8gRcpSQo4QcpZSQI+QIOUKOkCPkKCFHCTlqGWgQzt7qjRSINqZ2TBqqt2Y23b493D6RPjb829+G160Lt/Z8GPmybQgfi+Kyt3sPUu/JvW+4ofVubUdvRHMuHc6ba/Xaa2HcBSwdwvfatWHs/FGqtQ9640TvvhtuX0i3Tb3RioQHiSiS1zs49tze3Lo6XY486bnCkzPtMcvnik9OebuZ85DG6gB9//1h7FwbJ6pzPCaJrYiMCLKYM6aBAI2kjrSNPI3LR7zGyPUV3XFHGG1y+GnHv0MAVG67LTwpuNeXUOf4emGxc72SeBhwQ2Fc4M03h+uFxVphZ5wInX433RTGsfVQ+TAYMZUScn6nRXYk9i2Lsww1XyvjQdLWKOQIOUKOkCPkCDlCjpCj1MELObN3tc/IBvMNOHr47GefNNRwZyFHyBFyhBwhR8gRcoQcIUepAxxyZgSA2SFnzj8KOUKOkCPkCDlCjpAj5Ag5Sql9BjnDb8734szoKzZzQs7wwPrVpILE6qHmG1bOEXKEHCFHyBFyhBwhR8hR6mCHnPnIZ/QDM8Pvz3jgjK8OjQ41CzWp6SrjdWtnp7eHiTHBAC++2HrX5VTI00cfHW5HhBE3yQC5M2b15JOtN7JKa2t7M6rier8YrlGExx4VZo7PnesSsFWrwu1T4REu5R18vvJnW7h92Js4gWPZn5YINIlLcSx3riidO9d3IZ+cxx9vvdG9NuDhr/QmeeKKkMaQp7EVXVV1sRWAAf1aMHbGyEjMyMTYunVr5XqoOrjj8gEMeNyRp+vUi62oNUOOxzQwSVwRaKpGIFSxbdoURk0h/ipcvz5c97ZNYQBuxTpjaw3PWDo8GzVr1UVtWEmANx6G5CUjplL76Wdy5oST2cFjlgFnfz/bjIcIOUKOkCPkCDlCjpAj5Ag5Sgk5M73wMt+ec/LMfPywhyBndA5CjpAj5Ag5Qo6QI+QIOUKOUkLO3O9Sm/FjLXsZchbWUiDkCDlCjpAj5Ag5Qo6QI+QodZBCTt0oMMu70Rb2QZoZuWWWOdiuJuQIOUKOkCPkCDlCjpCjlJ/JGekxm9SuNmMl2pzjz/LizOgcFvA/9qjJkDOIqgk56NdCz1VZPoach+oq1E+xyaoGhrK6aseOcPt0OufM8rG8wEHMBQb8JlyCCo/FFa1Iry5d48Qh6fp2Yxp1M1tZTYah6mqykWcjh0Lq43mTPOsrGlk63AXc3/Zm+DMtXK7Gyy+HSTXojEI2RcFUGd3Yc4XgjpGxFSNja40EyPH1nOu6LVwC1gqXgE7DK64IY+u114YxMrZec00YjyxGrqvY6p1xvXgY4EkjA5+uvjqMlayfSRg0BdaadMvw440547z1044LxMg5DSOmUssccia9zrMPNfp/le7lcYQcIUfIEXKEHCFHyBFylFL7H+QIA0rIEXKEHCFHyBFyhBwhR6kDBHJ8uUMJOUKOkCPkCDlCjpAj5Ch1YL5dTSkhR8gRcoQcIUfIEXKEHKWEHHVQqEzbGRkH3WuR8/B7H+1qgyKvzIgjrV9P9Ca3tDt6o8aNdDFyompWzKbt7XBG5MceCw+I6JZ0BUi4ovqWoaeOUFf21A1yfHjsimLp0J7XPp/+RHrkeu9I58QObeEcqmZpThJXBIojIG0NgzxzGjt3hnkiJLk6qtbps459CO6ImxgKGRHH1s1dNafhepGJEUZr2KhBpeZDTBLnxV2oGQCrAU/CGOw8qTANlwBPenKwM5Z90uLUNFWTNiaJJ+eqq8L14mDOaSOmUkKOEnKEHCFHyBFyhBwhR8hRSu09yOkblv16334t5Ag5Qo6QI+QIOUKOkKOU8pUcJeQIOUKOkCPkCDlCjpCjlJCjlJAj5Ag5Qo6QI+QIOUKOUkKOUilWSD1feCnLx/K8QJFFdZExjD6RzqGwcx2CkXrrQq16zpOKvGqMQdrGsataOIe6995w+1R4Wo9ZOyecJ5rUnzYJve6/v/Wehnx5vYupjxtrKYxjf/az1nsEY2pCQM678sowbiGiKsrH6p0n4QRavzBnDFW3YNXsgUnWsb5u7qqHqlkLl4+0XfZ6ceT6RDVNYecanuH6LtTYhq317a6vqObwSTBZP0hpI6ZSyxlyPiplkFdCjpAj5Ag5Qo6QI+QIOUoddJAz4/5zjixTCTlCjpAj5Ag5Qo6QI+QopZYj5OCLerfRbyohR8gRcoQcIUfIEXKEHKXUPoMc7PO7P87yTSFHyBFyhBwhR8gRcoQcIUcptd9ATv2FkHPAqMrTTPkZCut6sREUKduoEAonIdDEOrXq8geAlDiR11sTIH7/jhBRTZ5Ht95ssZsEVyPtecktI21jJUxmndoepEfMeREwOUKP5QNc0yO31hhTR+Q6i9euo+oiIuNIFRsqs7AzLr+u+ZqEExi5vl7MatLlT7qDuKJJrIUT1fhU48SkB6k+EWY1CSZrTJ0EdfXCJtQZMZUScvxMjpAj5Ag5Qo6QI+QIOUKOUmr/hpzfj+xncoQcIUfIEXKEHCFHyBFylFK+XU0JOUKOkCPkCDlCjpAj5Cil9hHkzIcxQo6QI+QIOUKOkCPkCDlCjlJqP4ac4SdtbFc78LWYBq3FVGYdd1y4tT9PBz698UbrPdKChfCNMIoTMfXeEc5L2LUr3NpX0neHkZjr3raM9a+/HsZQvGUjFFeB6JtvhrkaHOrN3rj72Pnll8P1NB57LIyH8BvfaL15Q9O/+lW4HZKuO9DqlSTUvZmueOm998I8Fl1kdctZvXOdem+7LfyDH4Tvuit8662VMTLC6O23h3Fe+OabwxgZW2+5JYxLwFbQVH0J9ZxxonpnnAg733FH+M47K+O8mDMuEI8KmvcWU5dXoyY6/XAsettwLEbGA1zf/fpE+EnBzlkuZ8RUajlDjlJCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpCjlBJylJAj5Ag5Qo6QI+QIOUKOUkrIUUKOkCPkCDlCjpAj5Ag5SikhR+0dZRp7991w+3T6k2Fwywh7lKVYGGoSPiFPD7DtN4XreI0wSjL5fPqI9AgglTA5Eq/jWMZ6Ylvm6aSpV18Nk/GwXEe2cE6S96iGumNLT6lTG9BU2b020iZXUhzvQnavZX0czrtzZ5iTRGcUklydmGHsnEmOJ6rpos7T9awQ+uswipiLY+tOsElrha3I01irmrWwc10+Vk8DI4MBcKL6WOyMhcXO9VphZ9yy+omtiahe2HpWGBmzwsgYqqyPM2IqJeQoIUfIEXKEHCFHyBFyhByllJCjhBwhR8gRcoQcIUfIEXKUUkKOEnKEHCFHyBFyhBwhR8hRSshRSsgRcoQcIUfIEXKEHCFHKSFHKWbiKl8iT7/4YrgmhLESsCd679jReiN8o6vqsMPCZC22q2GSmeOzjAsjwyN5um4qK4vL9l5TWfty78EFvhU+vPVetSqMoQZI8EY6avqOOKL1Ji6mLrkkvHJlmHefQ61Jh154IQyMQScW6wHzlg0W54N0Cjmvjn2YB7bWsQ+gUif1mmrqPjGkXpwIIwM2UIpVt37V7Vs4EWIu/mUFk4TRVIatWI0f/Sj80EPhbdvCjzwSRuUf/PDD4c2bwzjvPfdUxoNUV97VnW/YihNhVnffHcZ566Huvz+My8c6b906u42YSgk5SsgRcoQcIUfIEXKEHCFHKbXfQE4EgwXtOfsISsgRcoQcIUfIEXKEHCFHKbU3IAdfTN1z9hGUkCPkCDlCjpAj5Ag5Qo5S6v/sHcLp/zj7N4vvKyFHyBFyhBwhR8gRcoQcpdRygZz6CyHngNHJvV9/vfVu7eneCJTIxIh9TIGZL9esab1bW9f73ntb78FQwTwrVrTere1OZ/huL/ZmJs5pINjg8rEztmLOq1eHiROsF4ub8swzrTeyGeI1RuY6o8YNoT+HwuWDWzDyhx+GqezlG9BUMl7bED6qhYFPuXRYdmD5gD3yRHxU0kmt6JcCHrf2izS0LYwgiwSGHwakQMQ+7HzffZWRPrEVeRr0jH+HePTR8JYtYcyqzuII0EAgMA8wBsEd50UIBl3gEoAiWA2sFe4Crgi3rC4BwyWgXgyxHn7ggTAuH1trYxq4C3j64RpE77orXD+i9V3AVvjBB8O4wNxqxFRKyBFyhBwhR8gRcoQcIUfIEXKUUvs35Py+TmB2HBJyhBwhR8gRcoQcIUfIEXKUUr6So4QcIUfIEXKEHCFHyBFylBJy9kq72uzftF1NyBFyhBwhR8gRcoQcIUcptewgB//LTcEw/j85B5LO7c2CqU+l2ZFVK0rAMDICNPq1AAz4hcsyrrY5fUqY9XG11pS+v/ezz7beA/00XWpV+PHHw08/HZ7W2wZCGLnAJ8OoJmMj3Athbr0uHRjzJ3/SeuNYZDMw3rnnhvFsDHRvOvvi8Dyf2HqDxJCuSYDtpXCS2EhNH6IqUiBC8KSeK0TG+ljUXtUI9MMfhjEyWs4QgrGUCNAoeYPRkFZXouFEmAZGxrE4EXZGBRyI/4ILwpddFsa/UtQnqpv3cAfx5EzaitsNgxDwxIJpQemADTxmk9CrbpOrybPkQyOmUgc25CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpIUepWfSFNKqrUgiUl1wSHtOf9iZNYVJfCJNbEp8wZ6TPX/86zGqytrb3T3/aeiN8f/Ob4dbe6X3IIa33rl3hAQNAqPmK+rj33mu9W3svHcJ5164NQ4BJBvecM+gCWweTfDX8+RZud/d++eXWG2CGSWKdcexTT4XBw4NOv2CenTtb7wE+bewNEmNBXC4Onit2+iGNoQQMGREJEikQ7AHYAC/VxrHAGFw/JlkXl2ErKrMQQLE4dWVWXS6HobCS2BnBvb4p2IpjJxECFufHPw7j3z9QeYed0YCHkTFn3AXMqq7Lw9Jhceo7WLvuA8QzefXVYfzdd9FF4fPP723EVErIUUKOkCPkCDlCjpAj5Ag5SikhRwk5Qo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5SQo5SQI+QIOUKOkCPkCDlCjlJCjjro9ZvfhBeT1eqhFnPsEk6jHmqZTGNkqEUci7qp1r6Sfj4MMCsBeHC9lYATEPnhuHQWpnGoGiazmI4Yc2w6qaa1db15vTz2ht5PPNF6t3ZWOPNWu/DCMKq6sPN554XrobAVxokQCifNagmHWsJp1MfWQ8H4B56LLw7Xlw9jqEsvDWNnbEWOh+vrxdZzzgmfdVb4zDMr41hMcv36MMr07rknjB9+GDvffnsYWI6/7K65JpxEZMRUanlDzkel95T+33+FnPJ9JeQIOUKOkCPkCDlCjpCjlNo3kFNTyu+3LiHk/H9v3Jjrm/Wm2WelhBwhR8gRcoQcIUfIEXKU8pWcvfdKzpBkij/WbCPkCDlCjpAj5Ag5Qo6QI+QodVBDzpwsAYooXjOZ88WWOQ8v2GNOPplKUEKOkCPkCDlCjpAj5Ag5Qo5SQs445Iy+ZjLf1/UOQs6yVcRcpMBB39Tp6UqrV4cHWpt+N8zkelI6Uu9117XCGzaER8RYHyeaD/H/r9b0RkUYz3NYuK0McytQpL3Qe9Wq1hsLizv49NPh9ofptj19WjrxYUUYevXVMIRWt1deCQNyxp7JjaVTx6fz/r71Vus9VgAIYelCJ58c5vVfe20YV/iDH4TvvjuMraifQjkVqqvQzIZAiRPddVcYk0T6vOmmMNLnzTeHb7stjM43XCBOhOvFJdRVXcjT9VY0hmFk1KlhKKwk5owrwvVi2THUpCtCjxmGwl2o+eHGG8P1zvWxMJ4NPAz11no18h4ZMZU6gN+uVrzja05gmG/r6OFT+WT0ZSIhR8gRcoQcIUfIEXKEHCFHKSFnGuRM+oj/fK/k1O9YWyQICTlCjpAj5Ag5Qo6QI+QIOUoJOdMgZwEv1EzijVlASMgRcoQcIUfIEXKEHCFHyFFKyJnWrjbLazWL/EzOKDvN/lY329WEHCFHyBFyhBwhR8gRcpQSchYIOXu6XW30JSP/n5w9rd29X3ih9R7c4LN7D/J09QrdIG6+kMbWc8OEnN+EyxBcz2qAXtmBlnr33fCuXeHWnk1HYgao1CR2xBHhE04If/BBuGateuTWHuu9e3fr/VGpSSfCnGEy7bRLwIP0Sjr1xXQKIz/2WHig6lFp7dfp6oqYiRGgEc42bw5v3RpG2kbKB8ZMiuZTIuPIJSCpI9ZjK1I+frxxRQCGGoixM6I5EvOmTeErrgijqQxla5O2TiqIQ48Zitrguk2uNs5bG41/dQEgVgNzvuyy8Jo1YWyF68XJaRgxlVrekKOUkCPkCDlCjpAj5Ag5Qo5SQo5SQo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFF7QQh2TzwRfv/98CDmvpiGnktXOQ/lY4MTJdWUl1DPeTDyq2noqd5HH916T0SCd0tPivUf9J44jd+mK41M4/PhGr0G0/h6urqhrZ3Xe4zx4pbVl3DKKeGJlxBCFRvOW4M3Yx9C4fe/H8bOMOLmRReF62PrmIuh6hCM5ArXx9aTnDRn+NxzK9fLXvucc8JnnTXBZ58d/u53w/Wc4Zo96kdlMQtbj1zvjK2TsA3PFY4FEYFL163rbcRUSshRQo6QI+QIOUKOkCPkCDlKKSFHCTlCjpAj5Ag5Qo6QI+QopYQcJeQIOUKOkCPkCDlCjpCjlJCjlJAj5Ag5Qo6QI+QIOUKOUkKOUqkbbggPGADZ9Pn0BMjBUHXbGDSWPn+VrgN0AMOKFa33YBpfTn8lDT2TXgzjvdZ7DIEm8cOa9IY0VAHhpCsauYRVYVAcPKnHjCf6bHiw7Ohtm/AQ1kTEH5yrrgpv2FB548bwlVdWxshwfWw91Pr14frYyy8PI6oCn+q6rZq1JiEBcOI736l8xhmVzzyzMk40iZe+970whsLW+th6NZawTm0StGMaWHYAIbbiAiddb+5sxFRqWUPOR6X3neb6/V59Xwk5Qo6QI+QIOUKOkCPkKCXkLAHkLAA56kN+v3UJIWfOtFAEieH3R2elhBwhR8gRcoQcIUfIUUr5Ss7eeyVnmBaKP9ZsI+QIOUKOkCPkCDlCjpAj5Ch1sLyS87sv8Kt5TpYARRSvmcz5u37Owwv2mHMyUwlKyBFyhBwhR8gRcoQcIUfIUepghJwhRdSQM/qayXxf1zsIOXvvtbbZhchYd6DV+XIx0RylWKefHoaOPz784YeVW3s5HcLOi8m1Y8fGzjhvzQ9YK2wFIXzhC+FJGmOt03pPXLrqYaipBtNYtSqMDrTVq8NoYxrMam3vwfWG3nsv3FaEDz88PK0Fa1I1WV2KVWfTeqj62LrkrZ7VYgI0ttZ5Gsdia116hjyNE9XFdJddVhlAuHZtGMiH653EePVq1E8d5gwOv/XW8G23hbEVvv328C23hPGPcDjv1VeHa0rPlTRiKnXwvJIzyxu9amBYwIAL45PRl4mEHCFHyBFyhBwhR8gRcoQcpYScaZAz6SP+872SU79jbZEgJOQIOUKOkCPkCDlCjpAj5Cgl5EyDnAW8UDOJN2YBISFHyBFyhBwhR8gRcoQcIUcpIWcC5Mz3cZ2l/UzOKDtNmq3takKOkCPkCDlCjpAj5Ag5Sgk5C4GcPd2uNvqSkf9PziJ1b+86523Z0nq3tjUdQyFB1gyArcyIZZBlZFzEFR19dBhDDS6hOtEgBP9l77HFebY3fpVPWkkI523tpd6Yc02PWPZ6Vth58CCFsLW+3fV5B3fhld4nndR644a2tr03T3Ro6z2yzseEOdQkqkEYncQedZCtW7DqPF0DwxLi05TKLNLFunVhhOBNm8LXXBO+6aYwEB/hG7Eex958c/jaa8PXXx9GcMffBUAgANIVV4Rx+Ti2Nka+9NIwCvGw7LUn9bbVSF+zdAneRkylljXkKCXkCDlCjpAj5Ag5Qo6Qo5SQo5SQI+QIOUKOkCPkCDlKKSFHCTlCjpAj5Ag5Qo6QI+QopYQcJeQIOUKOkCPkCDlCjpCjlBJy1D7QYvIlA+Wq8M9/Hq4DJYCBHWiHhCfly72Wp8lLn02Xl8/rzW6uReXpPXe7D0u3zb0nTRIjg3gntcl98EHrXQNhaxt6o4rt058OIzGOdeu93fvFF1tvhjMkyDoUIl/Ci2lmq4+F0fo1Kebi2PqKsDOMpUMJWL0VQ9Vb8TdUPav6AusT1ZePYzGr+vLrR6XGYxg3FIAEILzxxvAdd4R/+MPwPfeE7703fN994c2bw/jb7eGHww891NuIqZSQo4QcIUfIEXKEHCFHyBFylFJCjhJyhBwhR8gRcoQcIUfIUUoJOUrIEXKEHCFHyBFyhBwhRykhRykhR8gRcoQcIUfIEXKEHKWEHKXaC+ndaWhX77oDDRkRcfMLXwiDiFpbmy5bzv6ghfOKUEfU2h1pnGhnutqK387QN74RbseHeQnlVuLECMasLVy3uq1a1XrX6/zkk2EUte3e3Xpv3x5G6B/Ms35E42HAnElTyYeDcjmg5oZ0nBcn4t0/KoyHf6CNYYQzJDnkPKTAW24Jo7mr7vW69dbwD34QxonuvjuMScL33x9GGIXvuiuMadx+e/jOOytjqHpkXFE9cn0XJp0XVWy4R9i6cWNl8AOGQm8b+uLWrw+jaw4747wAlUmPWX3LsFZYdtwyzArFdFjJcs5GTKWWM+R8HEAKKyXkCDlCjpAj5Ag5Qo6Qo5SQszQa/Z885tvUfwdfKCFHyBFyhBwhR8gRcoQcpYScZQQ5xR9rthFyhBwhR8gRcoQcIUfIEXKUEnJmhZzf8cOcr67M+apLsf+cADMfyRTw4ys5Qo6QI+QIOUKOkCPkCDlKCTmLgpz5XkUZ/Xoqnwg5y0zHpsu4+cd/HKY+l87gDsh57bXwWMwlQaS/3Hsw8pZwpt7Bzj/vjSBbV3VNXOeNlXOSyOKYFcI3j/10+J13wrjewaTjvLt2td7TQLSt6T1YyZ+FayDk4kAvpUOHHRZux6XbKWncl9hK8iynQSJC4x/CaB1kkdWQEZEgQQiYR80e8AMPVK6PffDBMI6tK7OwFXQB4/IRr+EaCBGRsc411OF6t20Lg/j/7u/CP/lJeMeOMIYCHmPpcLtrMqm3gqWxkvVjhqUDt9S3+0c/CuP+YuetW8OPPBLGsmfZmhFTqQP+lZxRrhj9/ox8Urw6JOQIOUKOkCPkCDlCjpAj5Cgl5CwjyOnRZZEgJOQIOUKOkCPkCDlCjpAj5Cgl5CyvV3I+GkjIEXKEHCFHyBFyhBwhR8hRSu17yJnv61kgZyog2a4m5Ag5Qo6QI+QIOUKOkKOUkLNnIWfGz8/M+d/d1K/J+P/kLB/tSN/Te+3a1huJuX0ifUiapVgvptFk9VZv/IZth6VTSPkM/eiLO7KFc+ugFAslYK+m30qfUzqGQs3XypXhd98Nn312uCaxWiecEB4k9Rt6D7rIwA9xRbiEAeS8EiaoTKiAQ+bHAzyYc2iETFaHDz88DIp7+unWux2eToxZsSJM1nr00TDSGIwAvWVLuC49QyauQ2E9q0n9aTgRkjpOlOlzBJBwInRzYXEeeiiMaeC82LnO4tiKHH/bbWEkddAUiBeP+6ZN4bpdDewBMsGsMA2MjK2YxtVXh7EzYLLuXsNfZ6hTq42FxcMA1ko8NmIqtZwhRykhR8gRcoQcIUfIEXKEHKWEHKWEHCFHyBFyhBwhR8hRSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpZSQo/aKmLfa82FgTMLGyy+HoaOPDj/7bPill8LY+YwzwgMyiaouJNePSrW2s/cYIbxVOtq3BkNt741pYM5sGzsxPJbyIXSCxZxPOqn1HuiJ3hNP9Jt0amV44sjhwQ09q/dzz7XepBp23N1bOrRhQ/i998IDAjyt9+7drTcvAVkNsb42+KGskGLoB6jAKC5DrAcDwJgVyASVWTgvCAHZFBEZOb7GCfyI1nVq11wTXr8+jKcBW9etC192Wfiiiyb4wgvDl14axr9CXXFFGNOo8Qntalg63AU8sXhUcAexc929hho33FAQEW5ZDXVlt54RUykhRwk5Qo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJCjlJCjpAj5Ag5Qo6QI+QIOUoJOeqg1/HHh+v6KYQz9Ji98kqYyr6p998PH3dcGJERv44nUg1S8hu9P/yw9R4banPvQVKPkQfHhiZdUWvPpeNEr73Werf2dG8kirELjJSPCqXWvp4OjV3CG6Wf7T1YWLDl84VxvUjmg1nFyIOtsZKf+ETr3Y5L5+ONH43ByI+FkeSQEQEqwBhUhAGB6tYv5EtMA6kXd+X668N4VhD6Eb5hAAOGqr1xY2WACo7FVlwg0jYiMpq76povGDvjGa2jOe4RkA/YhntU30EAA7YCkPBsYOf6vJgkfmJh8DCWDlthXBEq4PIhNGIqJeQsRr/8ey1+kPr7o6dYkmkIOUKOkCPkCDlCjpAj5Cil9gbk/HKghQHDnoOcJYSZBUPO3r9wIUfIEXKEHCFHyBFyhByl1MIhZ89Rx16GnD33So6QI+QIOUKOkCPkCDlCjpCj1H4POb/7Pl7eGb7g0+823z7D14vmPPVwJsMd+hHmPEt9xllmUryoJecIOUKOkCPkCDlCjpAj5Ci1f0POnPwwJ3jM+cfRrxcAOfXXs596+HW9g5BDsdcr+9OQXFeuDKOrqt4ZOY/nbV/pPbZzVFeNTLKsYqsnOe0S2NwVWr063I4Po/WKmfiQFm4b0qHf/jb8MU+lv9m7JrG2IrxrVxhzxhXxetvacO5MtM6tNS3zEnLOhx8erofCHayRfvDPAV9Np7IuD41w7ZJLwuecE0bV4Le+Ff72t8NnnhnG1u98J4ydcSIcW/tv/zaMraefHsbO558fvvjiMBAIURXcAjKpAzQYDxVh4ENUwGHr5s1hdM2hXA7H1jkeNLUYBMLOABUgAbbCNU1ha92AV1eiYSuMOwiYxFB4NtJGTKX208/kzJfv69w/9aj6DWOLgZwlmYaQI+QIOUKOkCPkCDlCjpCj1IH2drWDEHKKGgYhR8gRcoQcIUfIEXKEHCFHKSHnlzPiyvJ8JcfP5Ag5Qo6QI+QIOUKOkCPkKCXkTPswTBv7L2hGwWbPfSanOKMScoQcIUfIEXKEHCFHKXVAfSan2G1Su9os/LAwyNkT7WpCTlWK1VaF0YEGIW6hqWzNmjC2tnZ2OurUBlTzUvrt3i+/3HoPTrRksZ7hO3e+4ILw4ESR8ut2NZx3YgXcN9LQm+mq8621Xb1xU8am8WwaqiZZL85JJ4XHpvFMGqomWU8DnVj14qCojbNAkK2jeR0KkWvrqIpcC9eZuDamUc8ZqRdbazKBsZIwoi0ACZ1v69aFgV74aQenweeeGz7vvDC2wiDe738/jKGwtT4vjDnXO+NEWI16cerz4thJk8Ss6tVIGzGVWuaQs3e04LeBzfL/k+6d+Qs5Qo6QI+QIOUKOkCPkCDlKCTmTX6tRQo6QI+QIOUKOkCPkCDlKqf0Ycnx5RMgRcoQcIUfIEXKEHCFHKbW/Qo4ScoQcIUfIEXKEHCFHyFFKCTlqWevF9ISch2C3e3d4JH1+sYWnhO9BsVU0s02bRnsjDT3fe2waW3tPnMZbaaje+kK6Un0Jn/xkeOIllDm+vdq7nsbZZ4f32kpiVs8+G66nAeKFUNNHmESQrbMpolsdr+EpsW8kMi5mGpNSb522J2VxXOD3vheuhwLkXHRR5UsvnWCMfOGF4UmxfjGLs6+Gwk3BSq5fHwaXXnNNGCVvgHZsTSw3Yiol5CghR8gRcoQcIUfIEXKEHKXU3oOcvi7Zr/ft10KOkCPkCDlCjpAj5Ag5SilfyVFCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpAj5Cgl5CgVGiT109Lvpt/pjSKcOrnCY1F1Qzqy6WDOSPn3p5/s/dEUDYJ7MM/XvtZ6L+HlQ+i4w1aMvHp1eNLOg7axjeFPtd6Tzouh2IB3VDp3BiG0tqb34GG4oze2IiO19lT6W70PP7z1xpwHJX74SamgnYuD+IUSsGuvDV99dWWEwiuvDCMUXnVVGPViGzaEcSJsrXfGeZE+0cyGm1Tn2o0bw1ir2hgZS3f55WGgCHI8MPU736l81lnh008Pn3ZaGFvPPDN8xhlh9F1++9thnBf/llBPElsxMmaFpasfQtwU/Czgb1UYT04NOfBNN/U2Yiq1rCHnj/6o8l7U3MW8+5UOgEsQcoQcIUfIEXKEHCFHyFFKyGnV/x0ycZ+9ACFz/nG+7y/+FEKOkCPkCDlCjpAj5Ag5Sqn9EnLqfN9/v+CcvQ85e+LUQo6QI+QIOUKOkCPkCDlKqf0bchbwGsic+8w5Tk9Ec74WVPwf9MPvz/md4vv1eftNBynnCDlCjpAj5Ag5Qo6Qo5QSciZBznyv/yzy60lvV5tlzKV9t9v+pVfTP01j6696I30WtDoMdijRqY9t7d7eg1y7Nn1eOnT88WEOdVy6bN8aVHXBu9NfTcecaxRp7Zu9sbW+C2ONcAmTefkZA3j5a9aER0702TAJ4Q/C770XboeFa1xsx7RwHsud/7D1HiPeeAhPOKH1xtZB2Vpsfeut1ptZDcZtgLEzbgNyfJ3yyxTYbr01jK0AMxjHwmXt1cixdQgGAuF6cV4YWRwECOb57nfDgI1J5WPofMO/JNVFbWBLXH69zrfdFsYdxLF4kIC469aFMUkgEHYGamLk+orwANc/CzmUEVMpIWfqG8Zm/ONy+76QI+QIOUKOkCPkCDlCjlLq4IKc2VsHiveezfjKzNT9hRwhR8gRcoQcIUfIEXKEHKWEnGn5fhL/zDjsjBCy114REnKEHCFHyBFyhBwhR8hRSu33kDNf9F/kZ3VGP6KzsM/MLOFncmacuZAj5Ag5Qo6QI+QIOUKOUmq/hJz5+sfqN4/NDjlL0q427EMbvr1tUrvawQ45WP1nn229d+wIY2dEVWz98pdb7127wu2Pw4OHIJBg1arW+5VXwvUVDUZek85s+sXWe0A1UJaPJYrgtzM1ciKMHFVdd9zRelOr0tRj6bj8idVzE/Tcc2FcAu7vYDVOTWNxohGubnUb+JX0M72feKL1bu2NdDUUWBpb+WwgfuH6gRM33xxG6L/77vCdd4bvuy/8wAPhLVvC998f3rw5/OCD4R/9KHzvveEf/jCMiIxcC5xAJr7ssjAY4Pzzw9gK4x9aLrkkXANSfcsASKgXwyUAclB6duqp4b/6qzBqzYBPa9eGMUlgDB4VPEi4oXfdFcaxwKf6ia3hCsdia/2TUkNdEpERU6llDTnLLDPv1/8pzQIuQcgRcoQcIUfIEXKEHCFHqVn18a+o31vIOYBjdlNCjpAj5Ag5Qo6QI+QIOUrIEXKEHCXkCDlCjpAj5Ag5Qo6Qo4QcIUcpIUfIEXKEHCFHyBFyhBwl5Ag56oAWstrX01W92KCqa1f67vSL6Yh9p5zSeiO5Dk60tTdy7fbtrTcucPXq1hs7T0r5dc3XIG2fnn4hnazVbgh/vvUehG8IQ6VyqBdeCOOKED8QIXBs+0x469YwRE47Kp3CLRtcYHbrZZ3aYWnO+ZB0ed4xxgMCRbcejiXw1w1pQAJsBTDV5VTYCl91VWXsjCIv5HgUaiHHn3NO+NvfDv/t34bRVIbyMZwIVV2YJMgEKFJn4rrjDr1edesXttaTxFbcUGAMjp3UU4efdmAMEPeRR8IPPRTGzmBp/NWAY7HzPfeEwdKAZ/gHPwjjitKmbaWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpAj5Cgl5KiDXnWCRDhDZKyzaWsv9a6RgIdmVG3tjPRp6aCplStb71pHHhnmBR6TXpFOHXJIuLV30z9Lv5SutSO8olUuufSoo8LtxPSItvUeXG/q6HSG/rF7dFZvdK+1tqH3GHt8ufeLL7beg2MDVLAzng2CSl5ga5vTr/fmeetwhjyNbIq+qTrIYmRERnSv1emzNq4IUIsrQo4HeyCpgxDwfNfXCyPWY85YHLSN1eG7ribDzgjcOLbuMYPrejGsVY1AWJz6qcP9xUpirWAsDh5CuF72emFx93PpjJhKLWvIQSklvBe1gHbZ+cbZOycScoQcIUfIEXKEHCFHyFFKHZiQM/ofYMz4n2QsFXjMMo6QI+QIOUKOkCPkCDlCjpCjlJAzDgwF5CwVnAg5Qo6QI+QIOUKOkCPkCDlKqT0LOcgGc8LDwqhjzuwxXyaZL64UGUbOEXKEHCFHyBFyhBwhR8hRSshZOOTM8pa2+T4203+xJF8LOUsjsMcguX6zN+JmHVXRZDVSPpZUMxaCs1BrRKiPA5pU/VqDIq8c6vjW+/33w0jqBBVATg5F1mpvpyfomGPCbMD7ZOuN+/uHfxjGVpjFZfVfH3m70YnV2jPhj3/GO69YEQamgktx3i99qfVGxd/IowIMz3uE1qt2bLpWncXrkihkYhjHIpvWrlMvEjNABfG6Tsz19dbJFfEavvnmcE2A9fXefnu4zvEI7vXO6CLbsiX84INhkCe2AjWxtT7R/feHcQk4th4ZWzFUzWlYZxiPaE2A2Ipp5KNixFTqIIecWT70v4BXhOZ7m9zo94UcIUfIEXKEHCFHyBFyhBylhJwlg5ypALNIyCleRBJyhBwhR8gRcoQcIUfIEXKUEnL2P8ixe0DIEXKEHCFHyBFyhBwhRykhZ2na1YqvZ/lYzpJ/JqeYkhJyhBwhR8gRcoQcIUfIUUrImTeE1EUCk/6fnD3aribkLIGQEXEPNm1qvUFEA73Qm7Ev9fbb4dZ+FUatWbsgHTrjjDAuAVkc2WxQLheqY/1A54U/0Xrjt3Nrm3rjEhiRy+AOThspiJumD9L3h8GHi5gkoulAW3oPAHhj6RBO9OGH4REOT0089tfpclowMvEk5sHWOm0DJ7AVPVfIxHVxGWADJWA33BBGuxp4CT9IyLVYOqxG3dyF0I/gjoiM8I1pTKq8w2rUQIjzYmud8uvQj2cDO2NWuGX4PQGvXx9euzZ88cXhCy8MX3RR+IILwueeGz7vvHC9NYcyYiq1rCFn2ahGoP3xREKOkCPkCDlCjpAj5Ag5SqmDGnKUkCPkCDlCjpAj5Ag5Qo5SSshRQo6QI+QIOUKOkCPkCDlKCTlKCTlCjpAj5Ag5Qo6QI+QoJeQoNdTX0hM0MW6+mX42HTsffnjr3dpbvSclyI+maHCJz/eeNBRoanCiN3pjZ8DkgC2/ng5x51XpY6e0fk25fNxBPBvYGZOctPNizjt2CVGmh/MOePix3vUkIQBSu/TS8OWXhxEKr7givGZNGKEQkbE+UT0yjsWJzjknDGr/9rcrY+dvfavymWeGMRS2YuRJnjTns84Kn312+Hvfq3z++eFLLplg3IXvfz/83e+GsTiYJC5hkuubcvrp4b/+6/Cpp4b/+38Pf+Mb4f/23yqfcsoEn3ZabyOmUkKOEnKEHCFHyBFyhBwhR8hRSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpYQcpYQcIUfIEXKEHCFHyBFylBJy1EGvk08O18FuEApfT0OnpqssftJJ4UnVVYNZ3dmbgbI90fv991vvgWq4ej4dqRd9YnXXXC2kzXZYeND59kb6m72xMzE1iYjXe1wLo2wt9cIL4dZeSn81XVWicZJHpdsvwtyaOj6Mh7Bu3ht76uJRmXa7kePrxIzkCrqoG6XqtI2IfNll4XXrwhs3hlG3hUq0G28Mo3wMjWHo9UJjGFx3zaFsDVtxLMrlUD6GNjnsjK0oanvggfCDD4ZR8obzTipMqzvf0J+G6jmcF7OqW/uwklh2VMDhxwwPEigOHA7ShkHpV14ZvuqqcP6IGjGVWtaQ87//d+W9qHn+QXxRAy7+2CWflZAj5Ag5Qo6QI+QIOUKOUmq5Q075np1p+yw5NS3JsUKOkCPkCDlCjpAj5Ag5Qo5SBx3k1DCA78+4m5Aj5Ag5Qo6QI+QIOUKOkKOU2geQMwvALGyf+V78Gf3+KKjMMvKMYCbkCDlCjpAj5Ag5Qo6Qo5QSciZAzpxfj35ypviiHrn4HI6QM4eQekdy/Ehw/2Y6hF9tdZEXY/2h4cMOC7cV6XZW+jfpEH4dwwjfRx3Veo/F+iq4j2AMkeDJ8GdbOK8XwZ1rlQViuN0sEDsmndT6+c+33kARROJ6zrzAz7dw29b7kENaYerE8OAh3JnGLVvbG2v1wQet91tvhfEg4dngT9m114YBDDB2xiVhK3Di5pvD9cgAFVwSUi8CNHZGCL7ppso47zXXhPGXDpLr1VeHsTN66rAVabvmNMx506YwpoF7hJ0xFBb24YfD27dX3rEj/OMfh3/yk/Cjj4brkbduDWNWwDYgH/Cp3hlwtXlzGENNQi+wVtqIqdRBDjmzfCanHmf0qAKcZhx5YRMQcoQcIUfIEXKEHCFHyFFK+UrOQvaZ781mo5Az/P58/8GJkCPkCDlCjpAj5Ag5Qo6Qo5SQsw8gZ8bvz/5KziJfShJyhBwhR8gRcoQcIUfIUUodaJBTfPRlMe1qs3wmZ3Sf0aOKT/XYribkCDlCjpAj5Ag5Qo6Qo9RBDTl1s1mb/v/kzNKuNt8hS96uJuTMp0i9J5zQekMIwah9GqT8S3oPbswHvQctZ8FLpKmkmhXpj3GjN1I+c3xePmAD5x0cO0G8hCPC2ErmyevFL3rsjLuArYO1uiecs8LijDWG3Zt+O11D3bfSENgDJ3o6XT2xY3qxN1YS9Ng+GX722fCgiS6o9YILWm/CBoI7ojnwEVvrRimEb+R4hG+EfiT1+ljwEraCW3Ai7AxjGjBQpCZAnHf9+nC9zthaG3cBW1Eghq31rHBDsbBwffkwrhfFZXBdxIe7ANIGioCW0WJ3zz2VsTOY57bbwjkNI6ZSyxpylo1GP2Ozz2elhBwhR8gRcoQcIUfIEXKUEnIWjhYihJAj5Ag5Qo6QI+QIOUKOUkrIUUKOkCPkCDlCjpAj5Ag5Sgk5Sgk5Qo6QI+QIOUKOkCPkKCXkKNVQIdXa9jQCJYQSsGpk1LgNkmuQCUqxEDdffTUMnXxyeFCYhgsM7doVHigmydRb6pVXwrzeEZ3W+/DDW+/PfCY8prLzLWlqgCKVMKvWzkmH0IoEbMPCotTu1FPDrf1lOpUFcR+VGhDgJG1Nh9C9xtLCGhiQEVHGhVgP4+mvMyJuwwMPhNGChTBal63VRjbFnG+/PYy+OPAhAjRiPUI/1hkjo4ALERlbMQ3cUBh3EMfWXXO4v5gzjKFqPsRaAczwLxyAK6xkfb24RzDWGVeEhwF3ATtjrcqdjZhKCTlKyBFyhBwhR8gRcoQcIUcpJeQoIUfIEXKEHCFHyBFyhByllJCjhBwhR8gRcoQcIUfIEXKUEnKUEnKEHCFHyBFyhBwhR8hRSshRKnXSSeF2SBi/6Z57LozIiFqzMSQAL4EBoqoLJ0IoItV8IYxj/92/a70Heqs3L+GzYSwOpoH6OCwONGiiw+IEeYIAMTKmgZHHoC5ONNJUln1iH34Ybu3s3gBRaHCiiktffDG8ZUsYaI1ZcZ2T8QZtci+ULukxH2BeIAqmAAxggNqbN4frvikY00CgxJN0551hzPm++8LAJ8wKWx98MIw7CvTaujWMnbEVI2OtavRazE2ZFNxrqENSBz/gHmFhsThYDRAv7iAQF0uHnetj8dTVf33DNXnWCITHO481Yiol5Cxb/fLvteBj9/QphBwhR8gRcoQcIUfIEXKUUguBnF+m5vv+fEl9vmOXkEP2KOQs+LzFguzNSxByhBwhR8gRcoQcIUfIUUrIGQnlv//jLNF8Mccuc8hZ8LFCjpAj5Ag5Qo6QI+QIOUqpAwdy5ntt53df/P47852xP7Year7Z1sfOcuFzTnLOV7T6/UdPeuBzjpAj5Ag5Qo6QI+QIOUqpAxhy5hyzeDMbCKGexizHzkk7C57kfEMV++/l16OWiXb3Xrmy9Uae3rkzPEmD5q5vpr8ePrb1HjAASS0dSR2x/uijw2MjV6w1oLgtvbF0rX05nR13CQztsHSZpwctZyFMcux6K8YbYcty6QaOyx8MtS19QxpPTnUJg60AlXhUBotzehp6ozeaqyD0aTGc1fVTdXMX2AMpEFvrTIyoCgbA1rovD37ooXBNNdhasweCLIzLr2M9jsXlI6nXKFL3xWHnGmPwYOHZwM4oPQO1r18frnvq6lnhRDBGxiVgGmjAq/vxMBS2btwYLsvljJhK+Zmc2UFldgZbGAst4ciLuQohR8gRcoQcIUfIEXKEHKXU3nslZzG5fGHIsYcgZ5TQhBwhR8gRcoQcIUfIEXKEHKWEnP0Jchb8Pj0hR8gRcoQcIUfIEXKEHCFHqYMXchb/5rHiEy9Tj539U0DzjTbLJ4UWADkHRbuakCPkCDlCjpAj5Ag5Sqn9AnIW85mcggewQ3Hg6HdmOcWM/xnOLJ1vM0LOnvtfg5aVzus9YA/oN73rJLd9exgJsh3Vwn8QHsTcHb0HOIEgm8DQzkpDz/V+5ZXWu94ZzV0gsXXrwti5PlFdeoYIwWkQgcLHH99686a0F3vX93cw+FO9R1aypNbdu1vv1u7sPbjeNb2vuqr1xjRwIjD86aeHBxf4fvqq3oOFhb7WmwuLP4NbACp1yxnCd721LsWqi9rqdjUY58UVIU8DGOpLwGrUrDWpEq0mE0yyLky78cYwgKEO7vhpv/LKMP6WufrqMIbCNDDJGmIBhChMQ+UdnhwYEIutuGW4oXhUgE/gpUsvDV98cfj883sbMZVa5pBzMKtGoCV5F98CTiHkCDlCjpAj5Ag5Qo6Qo5QScvY4Cx3wxCLkCDlCjpAj5Ag5Qo6Qo5SQczC+5iPhCDlCjpAj5Ag5Qo6QI+QoJeQoIUfIEXKEHCFHyBFyhByllJCj9kMh2P1l7zEEOiN8SOs9VuR1f+8PP2y9B7N6uvdrr7XeEH7RA5Bwoo9KtfZmGtqRnjANXEI9q7HGsBfTE6bRPh/+aIoG7PGVdK2Xeo89KlOuqN3Re+z+1jycj/e0aezqzfNm3mIaA7cBgRD7kFwnMQ/6xJCJ0XOFqi6k7bVrw5dfHsYFXnBBGKsxyRiq9oUXhjHU978f/t73wuecEz777Mrf+U74zDPDZ50VxrGYBoI7lr0sECMSwLi/qCa74oow7iBWEteLpTvjjAnGUPVKYq0uuyxc1rgZMZUScpSQI+QIOUKOkCPkCDlCjlJq70EOGpn9eh9+LeQIOUKOkCPkCDlCjpCjlPKVHCXkCDlCjpAj5Ag5Qo6Qo5SQo5SQI+QIOUKOkCPkCDlCjlJCjlKhQc6Lrqp2aOuNIDtAkRB2vuSScK1DDgkPImN2gh3Teq9eHW5/HB70tn05/HE67009G87FGRk5DVw87LBw+0T62DAWlnTBS3i797vvtt6t/Xk4j33ssTAukNebd2HFijCCOo8tr7d9KoxipzffDHOpMVS7uzemMfhZ2JreEMaceYtzZ24N9GK+RKMUqqsefDCMrip427ZwvTN6rnBelI9hklhK8FJdiQYwQ58Y0jaiKnI8kO+mmyoj5dfH1h13dbkcVqMuLsNNwe3GzgDR2njMcIG4R7gpdRUbZoULxE8srgiPGYaC69o6PDk11GXHnRFTqeUMOb8sZZLvI72LIOQIOUKOkCPkCDlCjpCj1IEPOXNG//6bc755ZPRNJfNtGn0rypyHCDlCjpAj5Ag5Qo6QI+QIOUoJORMgB+m//85wU/39ORlplt2EHCFHyBFyhBwhR8gRcoQcpYScfQA5s6DIpE1TIWe+F4Jm+f4sL0/NuSBCjpAj5Ag5Qo6QI+QIOUqp/e/tauCQ5Qk5oK9ZXm5a8NcHhfAL6K23woPKLMS+d3r/9KetN/UH6fZE7wEhbOt93nmtd2vbe//iF6035gzmQY/Zz38exs4vvRTGrBDrMasXXmi9iTFEkV/3rovLMBRqrgYrWVWxDXYGp4YHO38t/LkWnqaf90Y1V1uRPird1vXmsbkzqpueeio8uKHlyLnzKaeEn38+zJ8jnAgri7iJUPjII2FgzEMPhRE30a6GyIgsjqQOBIIxyYcfDj/6aBj0jK24ovoCcd56VjXFwVg6rAaQDwhU0wWIHz/A2frFkTOa07ihNR5jK7il/icNACFAtK7awz/wXHllGJdfksnI4mCSeLzzioyYSh20kFO/6DEVcmb8TM5c/a6zvtttlvfUzfh9IUfIEXKEHCFHyBFyhByl1H4MOVPfpbZgyFnMZ3Lmg5/53pZWv8Izur+QI+QIOUKOkCPkCDlCjlJKyNnjkDPLOAt+xUbIEXKEHCFHyBFyhBwhRyl1QEHOkrzja4+2q833lrnhSzqTPnvjKzlCjpAj5Ag5Qo6QI+QopQ4iyGnL7P/JGW1RK/ZfwAeNDnDhFxBKsfCbfeXKMLIaEmQd7OrzorcN5wWYLeF5wUs4L1bjuOPCTz8dxjTq86JRiR13bVdvRAic6Oijw4PgvrY38gaGeuONcGt39sbikAGSeXCPIGwlELafpV8J4wLBWiXkYDWw7FgNPvw49uO/Nzrj/j7zTJjH1oES4QygAmPnuuUMrivCYGTieqh6az1JXGBd1Fb3ttVQhxPV1wvXXXOTXC97fQfrtaq3TrpelJ7Vx9a9fPUV1etcP/xgnrJszYip1HKGHKWEHCFHyBFyhBwhR8gRcpQScpQScoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpZSQo4QcIUfIEXKEHCFHyBFylFJCjtorQhp7//1wa6f2vuWW1puRMQMl0/ZRlbHzIOaGWLaWMfeEE8I1iZ14YnhQERaXf8wxrTe2XnJJ6/3cc+HWtqR/2ht5+vHHw63dEj6ihdk2FijywQetd/tsGvxAIrozndPI7rUaRDHyoLXvtN7ouOODdGyalx835cUXW+9655tuar3roVDsNDbUN9O5sNddF77++jC6uTZtCqObC77iivDVV4dxXvx4w2gMqxNk3b5VG3VbOC9y7b33hlEghiq2uk4NWRzsgZuChrT16yvjiuqdcX/xJNVgBvZAQVxdHwecABDi/tZPLO4+HiQ8ObhAGDvXfIifSUyjbGYzYiol5CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKyFFKyBFyhBwhR8gRcoQcIUcpIUcp6qvhzKaMm58KD4Ldvb2Ra5k+qbPCmU0x1CAxR3UVW7/att6DrVl7lRf42mthbAU/DGYVufaj1Mg0EM2BIhn6SZ6YJPvEYp1BFyOzKm/Z5s2t92A1Huu9mOeqxhhcAugRa8Whcp3rE9WA9NZbrTcewhG6qGMfjGBXH1uXj9UJsp7GpJovBPe6Aw1ZHDANyEFrIVI+AAmQg63gB1xvzaW4C7hHWNhJrtcKW+vHrManSSODS2EAUs3wMHbGste8hJ1zVkZMpZYz5FxWan+J1x+HPach5Ag5Qo6QI+QIOUKOkKOUkLNkkPP7xDXL9xHSim/OctQC6GLOeQo5Qo6QI+QIOUKOkCPkCDlKCTlzJPupX8+OB/UOQo6QI+QIOUKOkCPkCDlCjlJCztJAznyxvgCJJYScOcesXxEahZz5Dp/l+6Pj/O7rYm5CjpAj5Ag5Qo6QI+QIOUopIYdfzPn17HOb7+up+0+a0oGhP+9dxz42d+WxkzIiQmGd4wfHRvhmnj483Tb2fuGF1htDrVvXemMrCpZq9CIwrEiXDWnoMatbzgaVaBPMG/rJNCcZzWzvvdd6s4mOvW15u9n5Flu5dJzGn/RGCKwBGLAB5hkwHpYLiqGAbSPTQBpDKEQmRs8VYt8114TrBInYh5HrQi0YI2MaqBe7/PIw6sXqqi5ADirCQCY11SCpg1twgZgkHg5UK158cbjeiqHQNVdjKugRnIbLxz88YCXxk1ODSv2I1jRVcziMe1T3py1iVkZMpYScIRjsoc/kzEcjxVCzwMyMwDb1+0KOkCPkCDlCjpAj5Ag5SilfyZnplZxRXpoRwOZ7+9mMr/CM7i/kCDlCjpAj5Ag5Qo6Qo5QScsYhZzHFAzNezoJfsRFyhBwhR8gRcoQcIUfIUUotd8jZt+1q9WdyZj/X6OHDl3QmffbGV3KEHCFHyBFyhBwhR8hRSu1PkLOA/ydnv25XK/afsV3tQNEfp8uqLrRvLWmd2p/1xolw7LQushx5pCIMxy6iPw3AMHjCYuexLB5CyVt9j+qmMpwXVVWf/nQYzwaOxTQGfWJBRHVdHi6ffXFU7Myitpqls+SNA38ujKdu5crwyCRz6fgA1+VUdRlXfWwNDJOy6aRmNpRx1UVtda9XTTU15CD0oyENvvvuMC4fK1lWdS1q6eo6NSxO3XI26bz1NOoT1RwO4p3UnwbUxMhY9nprSVNGTKWWM+QoJeQIOUKOkCPkCDlCjpCjlJCjlJAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5CilhBwl5Ag5Qo6QI+QIOUKOkKOUEnLUXtFTT4VHslpGxpGdF5MRj6qMSjRGRlSxlZVoHJw1Xz8PoyKMtWYb05t7r1nTeg/0VhgnwiR5gdC6MFN+gOgAF1O8wKvSIcAVRj7ssDBnxRNd13vAh6DWN3s/9ljrfcQRYVz+k0+23jhRXZeH5j1c4GDO8SAh8zNyITIiTyMUoowLRr6s+9NwIuRLpE+caMOGMG4/2tXq5IpoDgQCxjz0UPjhh8MPPhjGsWB6bIVBRICrrVsrb9kSxrGYBjrQcIEYedu2MHZGuxpOBONYLB2GwhVhzthaXwKmUZ+ovqJF3CMjplJCjhJyhBwhR8gRcoQcIUfIUUoJOUrIEXKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWEHKWEHCFHyBFyhBwhR8gRcpQScpRCvjwxncF9rDFsexhJndrdexBGY+sgBO/sXQdKDIUsDl7CL2usBpN6mVzZGJYedM3tCH88eGfOqp3bmyfCsn8m3X6RjtIzXMIrr4QR60GPoNaaENoX0uU689hcHNzBwYN0bjpL3vLZIADn/cU02GL3h+n2dm8cS8hBCsT9RrCrIyNCYZ3yUVyGLrK6x6wOo5gksviOHWGAKXaGH3kkjPMCcrA4WFhcPlxfYD2r+h7Vk8Qtg3GPYOxcP1cwhsJq1M9kvVZwDVf1k1M/7TUulgtrxFRqOUPOR/+r8v6ovw+rB+zphBwhR8gRcoQcIUfIEXKUUnsDcrqUOJkKlhwS5hxw+M2lOq+QI+QIOUKOkCPkCDlCjlLqQIOcPuXPkvj3NBUIOUKOkCPkCDlCjpAj5Ag5Sgk5C4ecAh4GAZLfnJORhi8K/e7rOV8sKvafBDlzjjPj9yfNX8gRcoQcIUfIEXKEHCFHKbXfQ86cX0/df06GKcbZ5/Ms5n8gCSkw0vagEyxKwJAv25HpbMGajynnrhcrgyxUx2sk5m99K9za++mdaRSmISLH1sFaxc4olBoIJwp96UthakW4PtFgktE2BkKACRtlu9prr4Xne2vs7zS4KdVq1MI0MOevfS2MZwOP2YBpq6bBp58OAzUR47HsDJRAESTIRx8NI17DwInaOBb5EiEYTVZ33RWeBEgIo7j8OtZjZ1TPodUNT/+FF4bPPTf8138d/i//JfwXfxE+7bTwd78bvuSSMCrv0K2HhwHrfOedlW+/PYxiOrA1jE6/G28MowEPc67rATErnBfXe/fdYeyMK8LDgNXAUDhR7mzEVOqghZw9+v0ZzztnNJoFZvbQdQk5Qo6QI+QIOUKOkCPkKKWEnI9meZvZIl/JGX372Yyv8Mw4HyFHyBFyhBwhR8gRcoQcpZSQswffrjapBW7qKzZCjpAj5Ag5Qo6QI+QIOUqp/Qlyina1JfysyyhULP6VnEnjL+azQ0KOkCPkCDlCjpAj5Ag5SqnlDjmzVJ/N+R6wSe1q9dvVFvNKziwtarO8TW5S29uBqE+n26ZwVoStXRseoMiWdGjs2Ci2QqcOqOaZZ8LIpki9g7te5enf/jbMbNreS4c+/DCM1HvccWFMY4ATANHNvQfda6lPpMtJ1mQCmnr22fDI5ad+9asw8LimVnS+YekG7Wqxdffu1ru1u8PsA4xjB8wTD8OGDa03jh1sje41hrM6fSJQIn3W+RIoAkJA5VTdkYWfybr2CpCDbHrLLWFcAlajroCrm+hQawZc/MlPwo8/Ht6+vTJw8cc/DoMeMWeE7zrW33ZbGDvjQcJa1c179d2vm9lgtJwBNurnGXCFZwNba9c/GrmzEVOp5Qw5e04H8X8gc3BKyBFyhBwhR8gRcoQcpZSQo4QcIUfIEXKEHCFHyBFylFJCjhJyhBwhR8gRcoQcIUfIUUrIUUrIEXKEHCFHyBFyhBwhRykhR6laSJCAjXfeCX/wQRiZGPywc2frja1nnNF6Uxk3EcbaseF6zrt2hXEJMDLDmCLm4ldqa9f1Pvzw1hs5HkJD2kgx3efDdQcaOsEGuio8pbdtgIvbw4e08Mix74R5bBBCDWb1s4G2rXrp3nsv/O67YazVoMXuw3ReL1AE2bQOo0jMiJt16EeQxXnrnqtJYHbrrWEkdVx+nXrrXi9kYvSYXX99GCNjknWPGXARKFIfi0mCgNH5dvHF4fPPD593Xvh73wtfdFH40kvDGzeGcctw92vXLWdwffextYY6TAM/C2CtkrSNmEoJOUrIEXKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpQScpQScoQcIUfIEXKEHCFHyFFKyFHq+DQKpo4IjwTo1Je+FEYKRNxEgoQQKNGghf60OtcCGAa1V6H33w8feWQYOv30MJroJs1qbJ2jtg6tXzgWtU9vvRUG4/EuHBauT4RLGLSc/bveg61r0sEAWKsBH1btasTj3HnQ6fdW75G7kM8zewjRn0Zn8SAyIiaNJIcyLhjHTirFgkFTGLmGHCRXuMaJe+4JI6rWJWCAutoYua4IwySx7PVQdfVcvex1JRqOrR8GTBLGzrgLgDrc7vqG4gHGyHXFH4yeOiwsdq5vdy6sEVOp5Qw5H+3YUfggSevz/Zc+/lc/Qo6QI+QIOUKOkCPkCDlKHYyQU70dZkGMsXi0+GguCTlCjpAj5Ag5Qo6QI+QIOUoJOTv2Dp/sOZaYcWQhR8gRcoQcIUfIEXKEHCFHKSFnHAPmexUF3xzu1u8/5yC/+3phL9HMN2BxoqV6wUrIEXKEHCFHyBFyhBwhRym1H0POEGPm/Lp+OWiWQUZBa5Y/zjLD+c5uu9rcSe6jUgNC2NYbOyOqIm6Oxfo702+lq6ouINCgyAuuhJQPBkByff311nswFo7dlj6195NPtt6tvZi+Ll3NGRgz+IeB3WHWmt2Txl14qjefjWx1G7vdO3uDxFq7Px167LEwy+OuCqOaC6oB+JBDwih5Q6ffAOryElB6hjRWUw0SJPIl6ALZFNVVqAhDrsV56yYrYBuGqkeukQ8RGTsj1z78cBgPx7Zt4bq2rgYGLDtWclKfGI6t72Dd6oZno76ESQSIoWDclPphQNcctuISataqdy4Zz4ip1EH4mZwCJ2ZHkanfn/p+s9lPtOSfGhJyhBwhR8gRcoQcIUfIUUotX8gpXhup34q2TyBnllnN90qO71gTcoQcIUfIEXKEHCFHyFHqoIac2V9a2WuQs+ATSTVCjpAj5Ag5Qo6QI+QIOUodpJ/JGf3YzFJ9JmfxkDP1U0MzfgpIyBFyhBwhR8gRcoQcIUcpdWB+Jmf2drU5+9YW9oGfSW9XK96NZrvaTEKAxiKyyWp1+vNhHPv00603kitiLnN8ZmI0WV13XRi/6eDWdqQrvfJKGIRQI9+gbqtWEBEi8iQQxWrA0CBtsxKv9+C8a3s/+2zrDb3xRviUU8JYWCSo+np//vMwIfZT4cH1VkyL8wKuBrScyicWkIOR8ZhNa8HCYiGLw8AnHIv0iZ+c668PgwhRqLVpU/iyy8KXXhoGa159dfjaa8P1zjffHAYwwNgZl3DjjWFcL47FzvU0ACpYdvSn4ZYBvYBt2Iq2sXoobMXIIEAgELi0Xkk8SKCaG24IY2sNdXWnHyZZ4rERU6nlDDlKCTlCjpAj5Ag5Qo6QI+QoJeQoJeQIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5CilhBy1V4QKqZ07wy+8EAaKDArEdqajMWz37tYbOvfc8EjKR+vX4emVYbRgTdJ554VRTYb01Y5Msz/t8fQbvV99tfV++eVw+2Q6NTIrKpCPfXHt+d5vvtl6r10bxrPB9rwM/QDCGuowSYDKAIGyES4fQp4obwq2rlsXJmlnmxxmxVtWgijxuC4QA+TUURWQg6HqMi6EbyRXRNUrrwzj4bj88vAFF4S//e3wd78b/v73w+efH77wwvBFF1UGXGFW+EsH58UV4eFAjq9XEq1fQE3QxY4dYXDLJIzByDUe41HBM1kTUW3wUm1cIK4IBnrhivC045YlXBkxlRJylJAj5Ag5Qo6QI+QIOUKOUkrIUUKOkCPkCDlCjpAj5Ag5SikhRwk5Qo6QI+QIOUKOkCPkKCXkKCXkCDlCjpAj5Ag5Qo6Qo5SQo1R2giF+4RcuKrPaMekym0J1U1kdoAcFYlVlFkYedGTFsfjNPlDmabBWu673IIv/rDf6tRCoCConhrG1pjhM46mnwq1tSp/We4BAp/ZmUi/Fyrtjw4cfHh48K+EBxd2bruhioOrJqX9SFjMyCqX4Zxg1Xzgxttau68XqmkK47jFDoMScr7kmDHzCrDAysjiMHI8QjB6zeme4Rk3E+kceCdehvwaVmpeQ41EvVveY4WHA/a2PRccd6BHdekDc008P/8VfhP/0Tyt/5Svh//SfFu6TT+5txFRqOUOOgKSEHCFHyBFyhBwhR8gRcpQScubWaFxZ8gOVkCPkCDlCjpAj5Ag5Qo5SQo6Qo4QcIUfIEXKEHCFHyBFylBJyZgOVYWgZfhORZlLaUUKOkCPkCDlCjpAj5Ag5Sql9+UoO2GbIOfORjzoQNCnJffKTrTdC4UBvpUsdGh7p9WLq3RLOyqzHHgsPYn0MVXeCDaim0mDnl3qj8m4si+f1fjxa5/xVPjgUnPaJMDB1sM4hbF2zJoyFxeXjWKzztNXAU0cOj7WqL7C+BNBy/WycdlqYl3DKKeG/+ZvwWWeFv/Od8BVXhK+9NgzIAT/UzFMbx9boBYzBzps2hYFA9c5I2yDgjRvD69eHcSzArMbFenFACDB2xsj1NLCSuN3YWo9cn6jsIqNrpp00KzxX9V3AyJgVFgfOekAjplIHLeTM+UchR8gRcoQcIUfIEXKEHCFHKbUfv5JTvI3Nz+QIOUKOkCPkCDlCjpAj5Cil9uNXcmZ5SUcJOUKOkCPkCDlCjpAj5Cil9jHkFC/IzPdyjZAj5Ag5Qo6QI+QIOUKOkKOU2m8gZwHtanMeqPYDIclNCpSnnhqu0zaGQr4cZMQgE8wKkLNzZ7gGFczqgw/CSK6Dd2oGmNWzQtfck0+23nUnWPt0un09nJeAZrZ6GpPADFtxCa++Gq778XBTBg1pJai0tb0H/XipoyrXxw6W7pl09bNQdwnyij6VXrcuDG7JNMadkdQR6+uiNgRKuI7mdbtaHVVRAobGMPSJ1fVid90VrkmsjuZwHaDrnWtCqI+tlw5b77wzjK65H/4wjP40rGRdtYdJ4gf4kkvC+CsJf1Giig2/gbD10kvDABU8oniuUD2HRyWbNI2YSi1nyFFKyBFyhBwhR8gRcoQcIUcpIUcpIUfIEXKEHCFHyBFylFJCjhJyhBwhR8gRcoQcIUfIUUoJOUrIEXKEHCFHyBFyhBwhRykl5Ki9IgQ7/PLCbzqmxox9GOr118Ot/Tz9s/T29Ju9B1l8U/orvQ89tPUmqCBu5hW9/364tXt6P/98693aL3pjrVDVdfbZ4dbeTocGnLYrHQSIxcFdQN4Y8MPudNzQV15pvSFUKH1UCqw12Pqf0xVO3H9/+Ljjwm11mk/swn80OOePSabzypVhrDOGOvrocLvvvvADD4S3bAk//HB4+/YwjsXO27ZVfuSRMEaGt24NP/RQGNPIQMnrffDBMG4wRobrY3EiMEANVxgZxjSwGjDWud4ZS1dfLy4QVIOUDyKqmQe3DMZKwljJetmxFXMGek2CdlANnKthxFRKyFFCjpAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5CilhBwl5Ag5Qo6QI+QIOUKOkKOUkKOUkCPkCDlCjpAj5Ag5Qo5SQo5Sh6bbh73RfPPyy+Fdu8LvvhvGVqbATJ/PPRcmXFFVCEaXz2CoIASEUQT3sfOGSWLHhp95JtyOCbNcju1qZ/V+883WG41hA0C6IP1Sb6zVoOMu2uQG5WNZEAec+GwaInucnr4qnG1yYwWAd4a5ksHDE3vqdqYhUHoqbzcWdiRtIwUi18KbN4cR7BCCYUwDcXPTpvD69WFUwOEmoRHussvCKNRCQRzq41Dzhbot/LQjmoMfYCwdtmKdMXINVzDIExBbTxInqoEQV1RfYM2leCYxVD2rGoHqha2r9jANECAWFtPIPkAjplLLGXL+Z6klTMR//6+uSsgRcoQcIUfIEXKEHCFHKXXQQI4UJOQIOUKOkCPkCDlCjpCjlBJylJAj5Ag5Qo6QI+QIOUKOUkLOHoOc31HK//08cPv9192HhNvw+/N9Z75vKiFHyBFyhBwhR8gRcoQcpYScvQc5Q0SZ8+s5X8CZ7/u+zrOfKGMfhPKxAf5G6Rmab9Cv1Q5p4fZOOqrYcCLgBIydx5gnWs6efLL1BtQh5hHbMl6DD1v7s96Dpbup9wBUMkBz6d5NZ8pPQBocuyH8mdZ7gHzZCPfxxDqT8RJjAAyom+JNKR9C9sWV+vDDMICwfpBwgXWbXE28eHLIeDV7lK1Q3BlJDsm1bgybFILhehp1zIXrXq+6Pg5GcRkK4n784/Cjj4ZrFKnb1eo6NRyLUjucCFvrsrU65dcYU18gpoFHZRIR1XyInUHaGBnH1o9KuXRGTKUOqldyplLKfJDjm9mEHCFHyBFyhBwhR8gRcpRS+w3kzPk2tiHGzPduNyXkCDlCjpAj5Ag5Qo6Qo5SQs4wgx7erCTlCjpAj5Ag5Qo6QI+QopZYv5OD1mfk+ojPfKzazfFZn+GkfJeQIOUKOkCPkCDlCjpCjlJCzDyBnlnY1vJIzy25quQixfqCADYTRxx8Po6iNyTXbxgYdWb/o/c47rfdAmbbbtnS2fpVVbEccEQaZDGDj/nR0ZKE/7aqrwojmqJ5D+K7f4jkSzct+PIT+//yfw+jHQxbHULi/6Hxr7flw1ovx2UDoJ4nlsmPnE8OD1QjwRpkeOv0GpB3Cw/DBB2GeF2ab3BvhuowLVIPYh6W8+ebwrbeGs1GKGbEu8pqUmGvWwsh1NMdqIKoCJ3bsCCOaT4I6HAvX3FJf76SkjknivPUl1OVjMFYSBIiFxV/9/+N/hP/u7yoDJkGeOBGm8ZOfhDEUtj722Ow2Yiq1nCFHKSFHyBFyhBwhR8gRcoQcpYQcpYQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpJeQoIUfIEXKEHCFHyBFyhByllJCj9pLQzRVC3vjVr8Kon2rtz3vj98gAGCJQDkrPwC3ZzMbIGBizbl3rPTjvlnQgAZIrEAgkBoxp7We9B1f0bO+dO1tv6OSTwzWIDjrQoFic009vvceOrXgJMIm1Qp0aqBXPxmuvhbEVI7/xRhgXOIDn4GGiSNLU4YeH61a3AYjGapDSV4dffTXMrIYgW7smBCRXbMWxNbfURAQUwch1yxlyLVajJsBJrAUCxNOPn+dLLglfdFH4r/6q8n/9r+G/+Zvw974Xvvzy8PXXh/H3CK4I13v33eHbbw+DeG+5JYytKMeEsZI4ETgcBrRjztiKakGU+NWtbvWjkgRoxFRKyFFCjpAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5CilhBwl5Ag5Qo6QI+QIOUKOkKOUkKOUkCPkCDlCjpAj5Ag5Qo5SQo466LViRXhQXJY1UBkK33sv3NpjvY87rvV+++3woAUrznvDDa13PQ2kTwQ5okgeiyyOPD1ggKqo7emnwyeeGK4L0zANpO16a2u70yiXiwq4mj0AG5Muvx2Xbtel49gBPb7Ue7B1Te/BVlTefSMdl//rX7fe0OCZDBGfWAGH81Yj82EAEqCqC3744cqgmnorGsNAF9iKY7Ez6rZQqIWOLIyM9Ikgi9RbJ3UYf4/UsR44gSY6GEPVOIGR63484MSkY7FW2IpJ1g14dZkeettq1sKsMI16YbEVC4vVAOQAkLA152zEVGo5Q86PSi0mAw/zmBJyhBwhR8gRcoQcIUfIUUodyJAjBQk5Qo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5SQsxchZ748NvzmjLspIUfIEXKEHCFHyBFyhByl1D6DnCHDzPmKzej3fZ1n/xDyFrrIEM5efz38/PPhgaIhbeXK1ru1x3sP8iWSetmRNejB6n3aaa03kGAwVNa4te3pn6dvS4eee64yzjuCEx/D5/weq4+DkogObb0RMNqRYcDkV78axjRghCL43XfDtZ55Jsw7eGjl+gInXRGfZzT+HZMu+wAJOXVWm5RNsdBoSKvvSt3bBvTCyPWxmDO610BTGAp5Gg1a2AoDn+osjjyNtI2dJxEC5oykDshZvz6Mzrfvfjd85pkL91lnhffczvWx6HDctCl8441h8FKNfPg5ymU3Yip18EDOLJQyH+T4ZjYhR8gRcoQcIUfIEXKEHKXUfgM5c77jZogx9RtzlJAj5Ag5Qo6QI+QIOUKOUmpZQI5vVxNyhBwhR8gRcoQcIUfIUUrtN5AzfLmm/kzOLJ/VwW5KyBFyhBwhR8gRcoQcIUcptW8gZ5Z2NbySM8tuapkKGXFSgtxzmfjrXw8jfSFf7toVnnZFcIIZGrRwXnALfsMOusj+vPcg1p+bvjO9Mw24CvQaTCM4bUBEoLjs1stojvixenX4S18Kt/aL3vg7hZPME9VveMWxmBW2ok2uJnzkWCwOToRlf+WV1ntANV8NYytiLqIbct7FF4fPOSdcx83vfCeMxHzllWFUkyH01/kS/ADYqGkKKAIkAAEC+WoEAokBRXbsCNcEiGNxCZPq8jBnLGy9GtiKoXC9YK1JW3EiAEP9MNSVaBgKF1gvLO5CfVPK1j4jplLLGXKUEnKEHCFHyBFyhBwhR8hRSshRSsgRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKCTlqr2iQAr/cexA3X+p9xBGtd41PdWHaYKjYeZAv0YGW0fxTrTdGPvvs8AAJNvXGsYNJlqvxxTCQALCBRiUu+7Gt94cfhgfr/FZvLN1VV4UBdbiEwbOBO1gBA64XNwVDIWzXjX8vvhjmHcwTHXpomKVnCbHtj9O5OIOfhYTYT7XK+YjyLuD2IxTCuGBERtAFtiLn1UNhK1zHayBBnVzrhrQ6T197bRgrefPNYRwLqIWxGvVK1qyFrXCNuLgE9DBu3BjGPyyBhy+6KLxuXRg1bkBc/INWDbG4v3XFH44Fa9UPUt1DWN8jIUcpIUcJOUKOkCPkCDlCjpAj5CilhBwl5Ag5Qo6QI+QIOUKOkKOUEnKUkCPkCDlCjpAj5Ag5Qo5SQo5SQo6QI+QIOUKOkCPkCDlKCTlKpRD7qAhnGza03q+9Fh4IFWG7wzzvlvCK1hvnrbcyXlMRr6dxS91Flql30GMWq4HEjOiCHP9RKTAPyASVUXVx2ZFHhrEaGPmdd8L1wo7wUgLhSNnax4vZuy6XO6pyjdZ86pIeMSsMhRtKIjq6heviMoRvXCFyHlJgzQ9wXVyWoXCExG68MYyIjOAOY+eaPTCrGhiQepHUsRWrUS9OHdzroRZzjxDrcUWTFgc713e/Xqt6netZ4UHC3QfE4jGrjy0Z3oip1HKGnI8+DgLz2yCvhBwhR8gRcoQcIUfIEXKU2v8gZwGb+nea7J1AvddOpIQcIUfIEXKEHCFHyBFylDoQIGfO13CEHCXkCDlCjpAj5Ag5Qo6Qo9TBCznIP8MsVGSkOb+PcYoBpQ0hR8gRcoQcIUfIEXKEHKWEnD0COXO+6gIKWtjXw1dyik1qL6kO0K39rPdIgmy39T7ppNYbeuWVMIRSLHZkAZ/YZAU9G86mMqDIs8+G26r0Z8PEmMPTGb5BRDh2xYow1nmwVtelT+0NnBjUqWXazlh/3HGtN3Bx0HFXDdXa470Hz1XunA8SFqeuNRugSFSiffGLrTdApab0es41ID39dOs9AO9curoVqi5MAyGgFAspEDtjqLrnCkaD1sMPhx96KDypbqveGSPXdIEfJMR6LDuGqmu+tmwJ19eLoeobev314SuvDF92WRh1aps2hXH3MTJgEoRQ4xO2TjJuCs6LWeEScIFgHlANnvayw9CIqZSQU1DK1O8LNkKOkCPkCDlCjpAj5Ag5Sgk5ByDk+HY1IUfIEXKEHCFHyBFyhBylhJwDDXJ8VUfIEXKEHCFHyBFyhBwhRykhZ17Imbpp73wmZ8a3qwk5Qo6QI+QIOUKOkCPkCDlKCTlBMov5z0CnQs7UdrXizWm+XW0fC7+7Ed1OOCG8alUYws5/8ifhQc6LOrU6Mk7q9SKZgMQOCZ98chjHYs58+tEJlhhTB2jiYp6XJ8o2OexMBGJtXeTpkZHLHL9yZXgs9FeldsgbOBaoWT91NfPUT059fweAFJcwVi1Y81JCDmIuiq3gOkBj57rXCzRVZ1Pcs7rnClF1kvGzgeQK10102Frn6bqbq26Tw86TRq6j+STjvKAaAHBtHAtfe20Y7IEfwquvDq9fH964MVyPjK0oMZz0EOayGzGVWs6Qszf/3V8uEHKEHCFHyBFyhBwhR8hRSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpYQcpYQcIUfIEXKEHCFHyBFylBJy1EEtlGLV1VWxFdl0kOR+kS7LuP51C2cL1qDGrRrqiSdab8zqyCNbb1STIV8N4vWOcOLEiy+GL7kkXFR21IUef683e6O5q7W7e49Vk9VkEpyGy8fIF10UxkqiBYpQl9Vz7KmDePeru4Anp17YweO9Jf1h78HOH6bxcxRbB9N4IlyXgMF33hnGVqRejIych1yLyIhsip4+pE+MjGlgzjXUoeXsvvvCqPnCyMCJ+gLLui0uHc6LOdf9eLheGDvXfXFYjbqYDhVwdW0dToQLxGNWMw9c4xPIBMYtq4/FzriDuEd5gUZMpYQcJeQIOUKOkCPkCDlCjpCjlBJylJAj5Ag5Qo6QI+QIOUKOUkrIUUKOkCPkCDlCjpAj5Ag5Sgk5Sgk5Qo6QI+QIOUKOkCPkKCXkKJUJEkkGvyZQ5IXfkq1tT0Mv9EZVF/L0Bx+EkRHrnVs7N727N2I9rpdNZXnsk0+23ozmLFsLEhtUk4XGCsQifA/S9s7C9R1sn0mPKMhkwC1r04kiBJXUYen2Wu/B4lwV5sgVtH/uc603Jolno25mq7cibmHOZJ46qm7dGt62LfzQQ+E65qKKDYkZaRtbJ9W44VgYs8IF4kT4WwY7YyjsjPPWwFAbEblmHqwkSAxJfd26yldeGQY9gj3qfjw8Ztu3V8Zj9vDD4XrZ6wcYi4NyuRr4ax7GNOofq/zBMWIqtZwh56PSSgk5Qo6QI+QIOUKOkCPkKLX/Qc4CNs33ZpnR//FzMf8l6KQTzXIu/39SIUfIEXKEHCFHyBFyhBylDljImfM1nBkhZyqoLAZylhZRhBwhR8gRcoQcIUfIEXKEHKWEnFk54Xffx6suw9dh5txtvpGLHeZ8hac+y6QXhZSQI+QIOUKOkCPkCDlCjlJCTsUbc+62YMgZokuxQzEZNVVRioXIiN848HHHhZFNV69uvd98M/zb34YRcwcdaCHG60PTqeeeC9f4BCHI1mZyPaGFPx8e9ImhL+71MArEjg0PGtJiKNyFwXkDCU48sfVG2RpG3r279a4pjovzMav0xuWvaOG8XiSZP/3TMI694ILwF74QHjDtl3vj/g5Y66zeg635Y9Xu7M1bhlgPYEBURezDD0PdNoY+MbRggcyQPmvjRNiKXFtfII5FNxdc17iBaupMjByP0I+tNQOAPOtjy/DNSdY0Bdc74y5grbCSk0bGUPXWui8OPxpYnEceCe/YEf7xj8OPPhrOu2DEVOrAhpw5PypTAMmM3DL7Z3JGB5l0FiXkCDlCjpAj5Ag5Qo6Qo5Sv5Ez4/MwiIWdh5xJyhBwhR8gRcoQcIUfIEXKUEnL2DeT0n58RcoQcIUfIEXKEHCFHyBFylFILh5zFVEgvOeTMOOZ8H+wRcoQcIUfIEXKEHCFHyBFylDrYIWcx/xnoAj6TU+w2CZzmm8bsZGW72iJ1f+9BYt7WexCRM8llGEUaqduo2nHpElRAYiedFG6HhOt6McxqcIHlNFDkheD+qfQiBD5E5xswBj/J2AqjqG3NmvBrr4Vxf7GwK1aEB/rz3vXOH34YBvFikqALbMWJsDi43fVWCiTGkre6iS6r58r4xbRd74zaqzpAo/YKkRFbkT4RkZF6b7kljL8LsBXoBV6qT4RZ1ZcPgx/q6jmct+5tq9vVAHX1FWHONadhKJwIC1v3xeGRrXvb6n8Mm1SnVm/FSuJ6sRp4GPDw5x00Yiq1nCFnGUrqEHKEnP+nnfMPvbI++/hFSISItNZEWgxpIhHSRCLCteaktTAR16ycWZmZlZWZmYWV/VD7pl/NzKxHnZmTcs5Mnbhv1nrKzMzMmlRIhIhEiEiISIhE9PTXns/7feA6fDjW/PF68fqn59znPvd9n1Ner3p2ETlEDpFD5BA5RA4AnDiRQ+EQOUQOkUPkEDlEDpFD5ADACRI5/H+OETlEDpFD5BA5RA6RQ+QAwIn5/64GRA6RQ+QQOUQOkUPkEDkAQOTAj49u7rI5b+PGKI3+ohVCfiqf8zQJ8oPzOb6hPWQn2O7dUWqv5tvVbOtX/qrdkRVCfkf2J3uzq/q01F/V4TtvS7sMw6Z8H/pt55sN7pZ8Gkh2zWedFaV5PVrVNGR5mypf9/r1URoxrDTvQ8+YfmJDtsktdOsWpREdok3MNm3n26hybSg0ba6t0uZLe3XhQtF+37YSzYZv0w625XL5pJ7vE8ufs03MefPkU77dUd549qzs4PzR5a/aB9nBpn2uncq+hXy3Xh4q9h3ZN1hVj/mCOPup6E+UEROAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiBwCIHCByiBwih8ghcogcIofIASByAIgcIofIIXKIHCKHyCFyAIgcOOmxP4BskPUdaLFFfV3UBIqeqs7EX3wh+sRsA6XP0zJBNoy5Mtfaui0rE3uvDdCjR4vWDw3tIbTyakeHaLffubNo2MI0exo2uTU8uvzByqOzn4olgQ2B+/eLdvsjR0apXfPq1VEaMb00LxO7jOgtNuxPy34btvPNQiVf4hexSpWVhk1GN3s133KWL+Oyx2FDYZX2uXbNFjn2uXZH+X6tfFI3bY3bk0+K7e3izJmivTprlmiv2pnzQrAkMPOqsRt86inRLiN/OPlF5s1jn2vaY3/66cz8K8sDKf9d2U/UeskiR78FRkwAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiB4DIASByiBwih8ghcogcIofIASBy4KTnzDPFOFf0aVs5fFjctEmMbqIdbDkRcVnpoUNR2r17Zpwq2p+Stl7s669F+4N+3z7RP6izGotKp06N0gMHxIiVpfYHvV2Gnco/V+/Xc1E/yG6hyQfpt2AHW+PZB+WPzuYN+1z/IMW6xa9Zn4Z9Kfbt23vtW/AicvarY9RFif5D6qJaIfztb6J1i7lypbhqlfjKK+LLL4t2sGkH21XZajJrnqpeyhPIXjXtc/Nla/mp7HPzU+XmG8PyHXdVV5UvEMvvt+rB2kXaq6b9I9iizu4o186cP9iqJ6kyYgIQOUDkEDlEDpFD5BA5RA6RAwBEDhA5RA6RQ+QQOUQOkUPkAACRA0QOkUPkEDlEDpFD5BA5AEQOAJFD5BA5RA6RQ+QQOUQOAJEDJz3251HDHK+D3fcVVGh/iFgvbdggWvPYfOno5Gr7tWxkXLdOtEk94lE1w1axNYkrfRp2zbY0yG4/r4tRo6I0/xZs2rYz2zXnr3owqLboyE61Z4/oDaCnsvfa0NsQwLL0zNap5Rlj34K91xamNSziy27BDrbfs93C8uWiBWGT+TK3ZpLzB/3Xv4q2is028a1YIVpcmVZiFkimPR0zXxBn67byxXT5grjcfH2czfH2szPzZWv5djX7m9CuKt82Zq/mhWBntj8n7Pbt1Xw/nu1ts1NZp+VfSh6i+d8p+l5GTAAiB4gcIofIIXKIHCKHyCFyAIDIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHgMgBIHKIHCKHyCFyiBwih8gBIHKA7WpaJm1tos1q9of1WWeJvqitq+rbqNrVqaUbN0apXcbBg5n5WG83aFfla740+ex+7b1VU36u3ZE9K7ujOXPEhnzKLsOG/mZ3pPiyNXmv/VRscZf/VOKNUhtr82eV/0Tt4Rw5In72mdjw6GRDmh1slzF7tmiPLt8155OrjX355q58dVW+9MwiJ1+oVbVfy6bPqk1l+cH5LdjON9MOzld12WXks3j+3qrvN3+wds35mfOLzLsl/zFUlUmeXvn6uHybXL7GreZUjJgARA4QOUQOkUPkEDlEDpFD5AAAkQNEDpFD5BA5RA6RQ+QQOQBA5ACRQ+QQOUQOkUPkEDlEDgCRA0DkEDlEDpFD5BA5RA6RA0DkwEnP1q1ivtjKZkR7b14m+dRrp7IhuGHaPiTqtG2fa2OAbSo7++woPe00sWHqFbp0ESNWl/qT1O1qthMsYnapf24P8YwzRLtm+1w7eNw40doyfhGl9l67SLsqe6/foL4aF6h25vOitMk194/SJtfcL0rtzBbA9suZMUP039Xpor3a8CP8VMzneGs+W1xmc7wdnK81s1PZOjV7NR++rR9M+1xb1Pb3v4u2qM1OZbvX7CLzPXX5xJwvTLOv0FaEmbYSzVL7ySfFadPEKVPERx4R7VXb8Wfae+0fK3awvWpXZb/+mTMzn346M9+Al6+emz5dtFuwa7bnPGtWIiMmAJEDRA6RQ+QQOUQOkUPkEDkAQOQAkUPkEDlEDpFD5BA5RA4AEDlA5BA5RA6RQ+QQOUQOkQNA5AAQOUQOkUPkEDlEDpFD5AAQOQA69PtobioNu7mWqrIyKx8KI5aX2uAe8WLp2rVROmiQuHevaL3ke720PXwWP1u1jXD6cBpK7KA6t7Rh6pVA2rw5Sq0tbRaNaCu1L6XhScrX/e23UWoH22zWEMDp9xvfqMKECaLNKg2/K0Mjx1rreMRmYtNW/tnYZwumLJDst2L9YP+mYd068R//yHz11cyODnH9etFO9corol2kJVAeSKtXi/n95u+1p2H/0FmzRrRbMO1zTcu2/H7tYPt+c60ALeosRZ54QrzvPvG228Rhw8T+/cVzzhF/8hPx2IARE4DIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBIHIAiBwih8ghcogcIofIIXIAiByA4xFdpxaxQOwv67aavVfxqsnfO1/ND55Xan/uN3uvBNL110dp1XubHay7yOJrtea9PUNs8l6tx7qDx6s1X3fdz2yGWkWHOlD9sbDdc7/8pfirX4m/+Y04ZIhoc+0NN4g335x5663i7bdnjh0r3nmneMcd4vjx4l13VWjvzU9li/nMu+8W7b32qtnKZdiDtYdjTzJ/dcwY8ZZbxJEjRft+R43KvPFG0V696SZx9GjxmmtEay27I3s4drB6bI59/wtw0sBgC0DkEDlEDpFD5BA5RA4AkQNA5BA5RA6RQ+QQOUQOkQNA5AAQOUQOkUPkEDlEDpFD5AAQOQBEDpFD5BA5RA6RQ+QQOQBEDhwLnKk6+TT2kWoMUPepW9UdqmHDt3FInSh68yzP9INXqHZHdlXbRD/Vpaqdapf6mbpfNfJXDb3IJq/aWP+lmpN/ofmp5qjGbjX/MeSMUo3NqjychhVwd6g7VUO/X5tNbWS0WS0fgu+5R3z4YXHGDNE2aM2eLdpWt2eeEZ98UrRNfG1tFdpVzZwpzpol2kVOnZppa/seekicNk2cPl20995/v3jvvaKFmTXA1VeL114rWh9W9UP+qgVhVfLZr67qvbY80e7IUsQe3cSJoj32Bx4QH3tMtG/QfkiPP57IiAlA5ACRQ+QQOUQOkUPkEDlEDgAQOUDkEDlEDpFD5BA5RA6RAwBEDhA5RA6RQ+QQOUQOkUPkABA5AEQOkUPkEDlEDpFD5BA5AEQOgMeG8blaMzH3T7ecefMYB9Wcr9Sqy/hYrXqvDcGt1MVeteoyrMSM59Qcqz5julp1gwdUY6pa9SRfVK08rYjGqHl6bVLtVfsB21Vdr+oCwGgTbei3WdwGOxuvbU+UbaOy+dIW89mr+RYs87rrRDtzlXaqESMyLQlsGZfdQtX92qnyNV92ZrtIyxjzz38W7b35Y7eqyS8y35Bmr9rDsfbIY8NKe9IkccoU0drSqtXi2Tr8qafEZ58Vn39eXLRIXLgwkRETgMgBIofIIXKIHCKHyCFyiBwAIHKAyCFyiBwih8ghcogcIgcAiBwgcogcIofIIXKIHCKHyAEgcgCIHCKHyCFyiBwih8ghcgCIHACf5Iw96heqTflpMNRlzHjVmKAaNvVWzeJVdXGlaoxQjUVqPm3nzFfzbrF1eWlcxQbVgqHmSTYh/+Xk6+NsBVz+JPN9gPJBy5ZF6bBhYsThUnt1xQrRd6+dF6LtMZs7N9N2RrW3i7apzLRR1bZgjR0rWj7Z1GvaMq58r1d+sG3fys2vym7BtKE/X1xm5sFg2ufa/eZ728z8G7z7btGelRXRNddkWpjZ/drnWtWYtsps3jzxpZfEl18W16wR//lPceNGcetWcft28aOPxB07ShkxAYgcIHKIHCKHyCFyiBwih8gBACIHiBwih8ghcogcIofIIXIAgMgBIofIIXKIHCKHyCFyiBwAIgeAyCFyiBwih8ghcogcIgeAyIGTnlNOESN2qZYTspzq8sujNHqo56uxRH2jdPr0KLWtbrbK6PXXxUsuEU8/XbQ/6WyXzwUXiBE71ZHqKlUazybViG9KP/ssSm2Vkc3imzZFacSnpQcOROmgQeLmzaJFzpw5URp9VJ3Fd+6M0obYWKsOLx0wIEpXrRLtG+zTRzSOHBHXrRNtcdnSpVH6+efi6tViRLv4XYgahHv3RmmPHmJDlm8ptfdGd/WTT457P/xQ3LZNtOnzvffEd98V7Rdsg+zbb4tvvSW++WamHfz9H6ul9mp+8BtviPaqXbOdyl61i6z6IHs1P7iVM+ev2t/P+edWfUf2defPKv8ge+wqIyYAkQNEDpFD5BA5RA6RQ+QQOQBA5ACRQ+QQOUQOkUPkEDlEDgAQOUDkEDlEDpFD5BA5RA6RA0DkABA5RA6RQ+QQOUQOkUPkABA5cNIzZYq4YIE4ZIgYsbXU+qFvXzHi0tIzzojSiEOlHR1RGjFR1KHQRqbhw8XevcWVK8WIdaUNr35W+otfRKktDWrYn2abyi4TL4nS7t3F7yf50quvjtKvvhIjxqqDSw8ejNKGxWVjVPmOFi+OUhsS4gxx/XoxYoc6XNUvNA6UWgJFLFVlJZqFisWGJa593SNGRKlFzvjxURoxqHT//ijdt0/84gsxYlSp/SYjhogWtfmInA+F+QRZNfXa5Gq+9pq4YYP46qviv/5VYT6q2kXm91vVD7n5qVp5zq00QP659mCrPjdNgiZBmF9V1e+5lYypaUtGTAAiB4gcIofIIXKIHCKHyCFyAIDIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHgMgBIHKIHCKHyCFyiBwih8gBIHIAOqs9xUWLxNNOE+NCNTrUTeqVpZ07R6mjSWBntjCzuLJCiFhU2q1blHbqJEbcry4T7VnF3NLJk6M0YkDpN99EqS1bi5ihriy1iou+YsMtyKnsK9u1S7Sxp6EB5qkb1LbSgQOj1CI2Ylzp6NFROnasaP0Q8bW6u3Tw4CjdsUOMeLC0a9cojdijbi+1LXYRb5ZOnBil0U+0xXRWy3Gx2sqIXLVQq0o7cz4x5/u1qgb3qom5qgFszP3R2rKVr8xiMtfa0r6UqubJy6SV/WlVJdbKOjUzbWkAIHKAyCFyiBwih8ghcogcIgcAiBwgcogcIofIIXKIHCKHyAEAIgeIHCKHyCFyiBwih8ghcgCIHAAih8ghcogcIofIIXKIHAAiB056GrZRyUB56aVR+sgj4tKloq3MGjUqSqO3eMEFYnu7aGu+IjaXzp8fpfPmiWPGiJYTI0eKDaP5fvVT9dbSQ4eiNGJ56Zw5UdrWJsaZatxRaiOy3ZHN0w17zCapL5b26ROlTn9x3Dhx3ToxYkHpkiVRGrGk1FaiRSc1Dpbu3Rultj/t4ovFiC2JdiqLdvtSbLVgxGR1dGm+S/Ccc6LUfgxegPkE2crIWDXX5tuo8hTJbyFdbNVS5FQt1Movo6qmqgqhlRDNAylvy1Z2kVVVTSvfgqXm22+LVT+V/JeTfgsAQOQAkUPkEDlEDpFD5BA5RA4AEDlA5BA5RA6RQ+QQOUQOkQMARA4QOUQOkUPkEDlEDpFD5AAQOQBEDpFD5BA5RA6RQ+QQOQBEDpz0dHSINsn16hWlW7eKPXuKX34pRqwrXbkySocOFW0YtW1UkyaJEQPV1eplpQ8+GKX2J6ytYvvqK7FhQdzH6uDSgwejNM5Ru6o6E0cMUeXRrV8fpRE7Si0XIw6rE1UJ0e+UiBXqR6UNG+EeVeWaGxa1yWoyW1w2frwYMUj9VpUlb198EaVxuhpviOkuQRuKqlYL2oI42+lnqwV9M1s+19ogexQXauVTYFV6VS3jqrqqqg+q2nKWD/35eJ2vnstvsOoyjuLquVYWxFVFTlVbHsWNfy2kJgAQOUDkEDlEDpFD5BA5RA6RAwBEDhA5RA6RQ+QQOUQOkUPkAACRA0QOkUPkEDlEDpFD5BA5AEQOAJFD5BA5RA6RQ+QQOUQOAJEDEBvVjtIpU6L0vPPEiPmlFgw+59nQ30WN+0tPOSVKJ0/OjBhQum1blNoSsIZJfUbpuedGacQcsW+UXn65OGyYuGuXaH/C2q65iFXqPFXGesu2K68UfXPXKVFq88a+faLt1oseIcbu0sGDo3THjswNG8SIPaL+GOzBehLocrmGnW9jSq2W42LR9vLZkjdbLdi5s2jLA/NdghHj1Qlivn0rb56qOa9qV1V+qnxErlqoVTUT55u7WllrZgdbTNovuCo1q77fVna+5c8qT82qM1ddZNVOv/x3Zb+c3M2bxffeE99/v5QRE4DIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBIHIAiBwih8ghcogcIofIIXIAiBw46bE/gGw0j9heumxZlA4cKNoUGLFWnaLK1q/Fi6M0YmypbdDymuov2tBvvWTp1bCazPanyV6v88+P0oYb/EpdUuqXobu5Iq4v7d07Sm2vl43mdgvjxokN29WWld5/f5Q2ROxn6nOlF14YpYMGiUuWiBGLS23VXsTy0oYdd7Ih7dChKLXka4jnA2qHOl08I0qHDxc9VL5PptK4XNRX29tF2+oW27eLFoiffHKi+dFHot2++cEHov07DFMn17pXc/OLND/8UMxftadh2jXbgksb3M0tW8SqR2fvNd99V8w/1645P/M774j2QXZwfvt2R+m3z4gJQOQAkUPkEDlEDpFD5BA5RA4AEDlA5BA5RA6RQ+QQOUQOkQMARA4QOUQOkUPkEDlEDpFD5AAQOQBEDpFD5BA5RA6RQ+QQOQBEDkA3cehQsaEBNqi3lh45EqURW0q7dIlSX7YWI0tvvTVK4wJVJ+YVK6J0/XrR/oSNmK3qniuNHL8MvaOIdeLpIcYdpRaEVnG2qaxvX7FnT3HBAtH+3LeMOf30KI1e6rlqbCrt1y9KbW+bpebIkeL06WJ0V3Xnmy2XGzIkSiMGl1p7NBTRAnWsOlDsFKV9+oi9eon2M7OnYYudIr5RbYehplc+BOcTs42qlgRV781PZcP3v/8t5pO6aRVXdZH297PZStXY/eZxZddsB+dfaFWo2MH5HVV9C/YN5l+KvTf/idrTqImNuu+oqi3Tp8GICUDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDAEQOEDlEDpFD5BA5RA6RQ+QAEDkARA6RQ+QQOUQOkUPkEDkARA6Ajua2X2vzZnHYMNF3RsVlpV9+GaXRWdVAithfunt3lEYMUBepu0sPHwi6XKkAAA+xSURBVI7SdetE+9PNsfTyDVpb1RXq6lJfp9ZbjaGi7vVqaI9BpXaDvk6th6p3ZKvJNmwQG9apzS3dsydKLZ9sTV/DVjd7VrIwrWEDnqSITV/79om25G3yZDFifqn9vE89VbQlfrbybtSoKLVNgw3xvFf8PhELV60Sj+ZCrXzBVD59HsWFWq0cbP/QyfdrVUVOPiLnM3G+861q+M6/hTxTW0nN/OC8LfPfZJ4x+XvzLXb5g6167GktM2ICEDlA5BA5RA6RQ+QQOUQOkQMARA4QOUQOkUPkEDlEDpFD5AAAkQNEDpFD5BA5RA6RQ+QQOQBEDgCRQ+QQOUQOkUPkEDlEDgCRA6ArwkaPjtKGafvN0k6dotS6xWYV22N2zjlR6pO6rgg7//wotVVs+/dHqU/MF4rffiuefbbYu7d42mnixo2iTdt+C7oRzh6sTdsNdaEjcmwvtbF+0CDRamrvXnHlSrFbNzHi0VIrogcfFGfMEKOvagvEokM9ogq2P+37/0PpRRdFqYVoQ3jLZTz6aJTmqwUtvA8ciNKGSh9V2rlzlOa7BJuUSW4+mttcmy/UqtrNlY+bVTuy8oPzFGllv1bNEFzXllZi+T6xqgI8iiFq2j+vzaqdb/n9Vi0PzG1l2ZpeFSMmAJEDRA6RQ+QQOUQOkUPkEDkAQOQAkUPkEDlEDpFD5BA5RA4AEDlA5BA5RA6RQ+QQOUQOkQNA5AAQOUQOkUPkEDlEDpFD5AAQOXDSM3Wq6NOYTuoRi0vnz49Sm7btz8G1a8X+/cVbbxUjtqiyXszawxbERdxRakuxZs8WBw8WFy0SI9pKbSqwEjvrrCj1O+qlaj02jNdfq4fUGep4sXuIp4hjx4rWPEOGiBGDxUtCjJXqglJbtrZpk9inj9irl2ipGXGlKk/Dzjxvnmj706x5evSIUlsP2GyXoIZKbCjNVwt6H1Yt1GrFmrHP/wZuZaFWfuY8cvLVZEfxjqpSs2qPmcWkWbUhrSoJ8gdbZVVb5tod/bfaUl9lxAQgcoDIIXKIHCKHyCFyiBwiBwCIHCByiBwih8ghcogcIofIAQAiB4gcIofIIXKIHCKHyCFyAIgcACKHyCFyiBwih8ghcogcACIHIEaX7t4dpa+/LtqsdviwuG6dGF3VmKMqGlfffCP6tB0rRN2fFvGxOlQ8I0Td3GWTusWV3e9zz4mWfJ6L/cSlS8WIuaV79kRpxKWltiDOciJiovppqc1Xvomuh6rPyra6TZ4sTpokrlol2ja5hvYYI54dpZapnuXxuqjP2S4jYlzprl1R2my14PLSrl2j1Jatfaf06xelvojPZrWqHVlV27fy99pCrfwyWgmVfOrND7bIqdqvlS95++HasmpPnY3mVW1pB9sN5qfKA6lqrVmaE24rqwXzr+ydd8T168UXXyxlxAQgcoDIIXKIHCKHyCFyiBwiBwCIHCByiBwih8ghcogcIofIAQAiB4gcIofIIXKIHCKHyCFyAIgcACKHyCFyiBwih8ghcogcACIH4FS1Dlt79UPRsG6rgjlzxKOJLi6zZWtV7+3ZU6z83JROqi4Qq3zvNrXqvRUH798vVv6AJ6tH78evB7/5pmhV061blHZ0iAMHivHMM+K0aeLdd4vXXy9ecYX4298eE/7ud+Lvfy/+4Q+iPQ7b0mgr//74R/HKK8WrrvqRtNV7I0aI112XaQebw4eL11wjHsVrvvZasZVbsFP9+c9i1S3YmW+5RbzvPrGtTbR/z6QZE2vWiK+9VsqICUDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDAEQOEDlEDpFD5BA5RA6RQ+QAEDkARA6RQ+QQOUQOkUPkEDkARA6c9KxdK0Z3tYsal5fa2qvZs8W9e0U/la9E21vapUuU2iTTq5c4YIAYMUEdoR4s3bkzSu0WGmgr/fTTKG0pRfKD7Utp8t52tYYeahOmlx45EqUtPY0m731OrTp4vtokkEsbNsLlnztPTQ/euFHMt5zZzqhNm0Q7ON+9Zh9kZ87fmy/FskVeb70lvvqquHKluHix+NRT4kMPiffcI95wg2gD9NVXZw4dmtlKXdgH5a/a5/7pT6K9agVo9WhBOHiwaJ9rZWKtZRlj3nyzaGVy223i7bdn2sF33inawePHi7a10F69665ERkwAIgeIHCKHyCFyiBwih8ghck5kvovv/iN/+cP9JY/9PzKNA5FD5BA5RA6RQ+QQOUQOkUPkEDkARA6RQ+QQOUQOkUPkEDlEDpFD5ACRQ+QQOUQOkUPkEDlEDpHDXxI5RA4cv8g0tnRplDab5Oaod6j5e2erFQd//XWUVl5k1Ty9QM0PtgF6r1pRJr59q8l729Tt6peqbUizb8FG85XqCvUz1UhvP7aoxgzVMnWPuk9dqq5S7eAX1Z3qVtV+DPYk7cwfq1sy0/Gryehmu9fyV3Pzz7X5cuzYzKqDx4wRbUS+6SbRDraqsYNHjxZvvFG0g0eOFG3anjBBnDJFnDpVtJWOzz0nPvusuGCBaCvCbPPevHmiHWzawaZdxsKF4l/+Ij7/fOYLL4hLlmRaxNrnmk8/Ldo124PNn7M9ST2YqgFg8QAQOUQOkUPkEDlEDpFzokXOSf4fDf5b/0mhlc/94a656sxH8TKO4n9t+9G+7qP1QcziQOQQOUQOkUPkEDlEDpFD5BA5RA4AkUPkEDlEDpFD5BA5RA6RQ+QQOUDkEDlEDpFD5BA5RA6RQ+QQOUQOkQPHLzarGTa6fa7aFLhatVeN3eoO1a7KRkY7eLlqY24+T9ukbverd9Q3RJ/jrQHyB2t3tEvVqzo1xCZ3tF+1g60Q7NWtqWmX+tPYpFohTFcN+yFNVe1Z2W/ykGrPOW88034M+av2rA6q2zJt/LJR1Wa1/FUbCs0nnxRtmaC9aldlH5RPkDZP56eyO5o7V8zvyA42LTbsfmfMEJ94QmxrE+1gO1V+GXb7dgt5ipi2a85usOrMdiqz6lR2g3b7+TXPnCm2t4v2qn1Hpr3XviO7DL1m/mffACweACKHyCFyiBwih8ghck60yOG/ihytOzrZ1iIfI8u4f7jv6Me5I2ZxIHKIHCKHyCFyiBwih8ghcogcIgeAyCFyiBwih8ghcogcIofIIXKIHCByiBwih8ghcogcIofIIXKIHCKHyIHjF5sCDZvVbIC2Qdaw6dOWgNmoZ0vALIHmip1CbLLWTD/otBD9c+2O7CLtzBZItsbNZnE7lc3xFkj2Xsu2dGGa717blGpXZY/dXrVAsh9DOsd7iOalbQ/241T7Uqw97JoNa7y8iOyx2wfZg7XPtb+PtMTyJVFVWjD8z/9k2l4vezVPkXwJWF4mpp3K7ii/yHyhVn6R+TXng7ud2S5y0SLRNpWZ+WO3G8xjsqouTDvYTpUnrpl/R/lzbmV9XJoxfrB+R/zPvgFYPABEDpFD5BA5RA6RQ+ScaJFzkv/XiRPgBo+RWzhG/sPOcfeXzOJA5BA5RA6RQ+QQOUQOkUPkEDlEDgCRQ+QQOUQOkUPkEDlEDpFD5BA5QOQQOUQOkUPkEDlEDpFD5HALRA6RA8cvNpzZnGeTXLvoW7+2q/ZeG6DHqDZQfqvm8/RO1T7ILiMfZA+odqqP1CzbRo+O0mYxaWO9Rc6Lqi0Qy9e4rVLzKd/4StVq9Zqyh2O3cKWaPw3bVGY/Ufsgywk7s8WkxYbGc0xR7VQrVXvsm9URasrzz4s2BNsAbQOlHWynyl26NPOFF8QlS0Q71cKFol1zniJ5xuSnyg/OZ2Kb4+1V2zU3a1ZmXhf5FruqRW32XtM+1x6OfUeLF4v2/ebfvr1qVv2e89WCVkS28u6BB8SxY8XrrhMHDRIvuaSU/9k3AIsHgMghcogcIofIIXKInBMtcv5b/3qe7cz85XG9fLzq7xQiB4gcIofIIXKIHCKHyCFyiBwih8gBIHKIHCKHyCFyiBwih8jhL4kcIgeAyCFyiBwih8ghcogcIoe/JHKIHIBjE1t7ZexQF4l9IjNmq7blzCbmJaVbtkRpw6lkJl67NkojrlalHi+6KEpHjBAnTBAtRWzAePNNcf9+0TOmv9pkvZg1QN6WeqomH2Tv1eTz99pV6U/lzBD9vRbtusatf2RaLfurGu0/+5l4jPDzn4sXXyxedZU4bpw4bZpo4/Urr4hvvSVu2iS+9564dator5rbtonvv59pZ7a/gd99V7QPsoPtVB98IG7enPnGG+Jrr4lr1ogvvSTaVjcrhDzb7NWZMzPtvbaozbJtxgyxvV184gkxD0KrODuzXUbetHrwCfC/234B4HiGQRaAyCFyiBwih8ghcogcIgeIHAAih8ghcogcIofIIXKIHAAiB4DIIXKIHCKHyCFyiBwiB4DIASByiBwih8ghcogcIofIASBy4JjA1kClE6RtGzsrRN9zZfu1LEXszHYZdnC+QUuvygdKe69NvbY/TW/fT6Wfm7/a5HP1g2za9lM9quoqtib3a0/SvhTb6qbL1vz7tWeVo9d8QZTacNLkvf1C9GpN3xuXqvnBg9V8MZ0hXbpsWZQ2+VwbGe3p2HxpU6C919ZPWWzYq48/Luav2qlMG1XzzzWnT6/QzvzQQ6K9OnWqaKfKB/d8B1oeDPnBNuXbq1Ym+fIxe9VOZd/gww+LU6ZUWPXeqoPvvVecOFG85x7x7rvFO+8Ub79dvOUW8cYbRf2XQ4yYAEQOEDlEDpFD5BA5RA6RQ+QAAJEDRA6RQ+QQOUQOkUPkEDkAQOQAkUPkEDlEDpFD5BA5RA4AkQNA5BA5RA6RQ+QQOUQOkQNA5AD4Ii/hO8XfaqP52eopqTFJPCdEO7iTep7a5IN0B1rPENMP6tpVjF6qvfdU9XzVXgX4/3/PoAvybDgbP160ofCBB8QHH8x85BHRyiRPETs4f6+N16bFhqXIY4+Jjz4q2qtWNTZe25McPly84grx178Wzz1X/OlPRTixYMQEIHKAyCFyiBwgcogcIHIAgMgBIofIIXKAyCFygMgBACIHiBwiB4gcIofIASIHgMgBIHKIHCByiBwiB4gcACIHAAAAgMhhOAMAAAAAACKHpwcAAAAAAEQOAAAAAAAAkQMAAAAAAEDkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcYPwfiUCGCo5vJLIAAAAASUVORK5CYII=31:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=32:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=33:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"5de68fd5147c6120bb7d5d0c","environment_id":120,"environment_description":"Windows 7 64 bit","size":81408,"type":"PE32 executable (GUI) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"Ricks75.exe","md5":"75c039742afda956785f94fcc6fc7017","sha1":"9e151db6fe07da99e9313459d7294e6a150b5e6c","sha256":"70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6","sha512":"794932299ab19749dddc60aac369a868f73cdda4f5577bced1bfd47ef546cc87acd8bb10e62537fb1964d690dcd3f5da74ff6e0a9a9630d76e82ea3a81b884d7","ssdeep":"1536:CS98Y9MUIaJw/yGU6H9ed2VEVNUmjolqVMqqU+hV2+70mXxc:Cy8Y9uJVbHo4Ve+mjhVMqqD/P7Xx","imphash":"a7a65dfc27ea5216005f53c9961541ac","entrypoint":"0x406800","entrypoint_section":".text","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2019-12-03T16:39:55+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["iplo.ru","isrg.trustid.ocsp.identrust.com","ocsp.int-x3.letsencrypt.org"],"compromised_hosts":["88.99.66.31"],"hosts":["88.99.66.31"],"total_network_connections":1,"total_processes":9,"total_signatures":54,"extracted_files":[{"name":"resultlog6.reg","file_path":"%USERPROFILE%\\Desktop\\resultlog6.reg","file_size":0,"md5":null,"sha1":null,"sha256":null,"sha512":null,"type_tags":["empty"],"description":"empty","runtime_process":"Ricks75.exe (PID: 1596)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"A62FD562AB6FC89C4B2A8A0110748922","file_path":null,"file_size":574,"md5":"4085e85999134a6df4c5279584cdcbab","sha1":"c4f47f6b74eb9453b42c3882aee455d38f131ce3","sha256":"dd02758f7260b26ff09403cb05547930ec9452a6db4ad1cdb02841b6f56c77a9","sha512":"568cf342842a4da31962f0b1298bcf2a788d7be46cff0597f25ca9b6d34b2fc9a28e1e8196486cfdbec9176bc0749e924e9fffdf9c09866644bd9ba260328741","type_tags":["data"],"description":"data","runtime_process":"Ricks75.exe (PID: 1596)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5de68fd5147c6120bb7d5d0c/download/dropped-file?key=f537fd1e69c571faa9590c509ea00cbe9ccaf26429e8f7f9207a50c34604ec9b2b486c72e1f2364098be57d29166473e852eecb2afb806edd8a6aff4ec6f7f36461981670e2ddbf0ffb9fe1838e12bf5f7bf00e7faa0b7b2d9cc0b","submit_link":"/bff/report/5de68fd5147c6120bb7d5d0c/submit/dropped-file?key=f537fd1e69c571faa9590c509ea00cbe9ccaf26429e8f7f9207a50c34604ec9b2b486c72e1f2364098be57d29166473e852eecb2afb806edd8a6aff4ec6f7f36461981670e2ddbf0ffb9fe1838e12bf5f7bf00e7faa0b7b2d9cc0b","has_overview":false,"extended_details":null},{"name":"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08","file_path":null,"file_size":1398,"md5":"dd11f0ef915a800fe4551f5ca8bad625","sha1":"0d1dce0e24b965fd3445af6fa38a492503410bc6","sha256":"dac374375193ef49a4ea0aa5ba28458e488dd5bcf35a2bd0214ddd3a15ebe7fb","sha512":"93a792c717a3d3265b6ec4c2fcc4c92abe427750345ee08a7c60ae9c3c2add5c56416ed09b4264ffea14d972f0cf1f6403b1b838c42f416d1ca6e5e95613a191","type_tags":["data"],"description":"data","runtime_process":"Ricks75.exe (PID: 1596)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5de68fd5147c6120bb7d5d0c/download/dropped-file?key=8fa21af79e84e27af10134e881d618857ccebcda79ff3535e639c7f2722cdb5eb499703a76fe1ed38f6b67d9386f2abdf6a634c03d4ff3a15e7f50d7a2d97166f3ac7b12f4ca6872c91aede795dba3668b5c11c51a3f47c2083d9b92a57f7810741fb766690f2fb2f052e9fac8f8963cb99508140cb634a8f6dc5b6c","submit_link":"/bff/report/5de68fd5147c6120bb7d5d0c/submit/dropped-file?key=8fa21af79e84e27af10134e881d618857ccebcda79ff3535e639c7f2722cdb5eb499703a76fe1ed38f6b67d9386f2abdf6a634c03d4ff3a15e7f50d7a2d97166f3ac7b12f4ca6872c91aede795dba3668b5c11c51a3f47c2083d9b92a57f7810741fb766690f2fb2f052e9fac8f8963cb99508140cb634a8f6dc5b6c","has_overview":true,"extended_details":null},{"name":"1LJjq7_1_.png","file_path":null,"file_size":116,"md5":"ec6aae2bb7d8781226ea61adca8f0586","sha1":"d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3","sha256":"b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599","sha512":"aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7","type_tags":["img","image"],"description":"PNG image data, 1 x 1, 1-bit colormap, non-interlaced","runtime_process":"Ricks75.exe (PID: 1596)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5de68fd5147c6120bb7d5d0c/download/dropped-file?key=c98fbfa9953fcc83f9d3275b4b737bc2028780a31de6922f7232d207c7cb455a75f9887c834a9e7ef0d32d52d3d24dc1bae1397a176423e7762a841a4b3881553215451d870bc40a","submit_link":"/bff/report/5de68fd5147c6120bb7d5d0c/submit/dropped-file?key=c98fbfa9953fcc83f9d3275b4b737bc2028780a31de6922f7232d207c7cb455a75f9887c834a9e7ef0d32d52d3d24dc1bae1397a176423e7762a841a4b3881553215451d870bc40a","has_overview":true,"extended_details":null}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 27032)","6 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 27032)","12 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27032)"],"imported_objects":["29 .LIB Files generated with LIB.EXE 9.00 (Visual Studio 2008) (build: 30729)","9 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 27032)","2 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)"],"file_analysis":["File appears to contain raw COFF/OMF content","File is the product of a small codebase (0 files)"],"total_file_compositions_imports":2},"processes":[{"uid":"00025321-00001596","parentuid":null,"name":"Ricks75.exe","normalized_path":"C:\\Ricks75.exe","command_line":null,"sha256":"70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"1596","icon":"$25","process_flags":[{"name":"Network Activity","data":null}]},{"uid":"00025643-00001776","parentuid":"00025321-00001596","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","av_label":null,"av_matched":null,"av_total":null,"pid":"1776","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025650-00001304","parentuid":"00025643-00001776","name":"vssadmin.exe","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","av_label":null,"av_matched":null,"av_total":null,"pid":"1304","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025853-00003052","parentuid":"00025643-00001776","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","command_line":"wmic shadowcopy delete","sha256":"da3ad32583644bd20116f0479c178f7c7c0b730728f4c02a438c0d19378c83d9","av_label":null,"av_matched":null,"av_total":null,"pid":"3052","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00026262-00002348","parentuid":"00025643-00001776","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","av_label":null,"av_matched":null,"av_total":null,"pid":"2348","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025713-00003488","parentuid":"00025321-00001596","name":"vssadmin.exe","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","av_label":null,"av_matched":null,"av_total":null,"pid":"3488","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00025859-00001892","parentuid":"00025321-00001596","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"/set {default} recoveryenabled No","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","av_label":null,"av_matched":null,"av_total":null,"pid":"1892","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00034246-00004680","parentuid":"00025321-00001596","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","command_line":"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4680","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00034335-00004720","parentuid":"00034246-00004680","name":"PING.EXE","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","command_line":"ping 1.1.1.1 -n 20","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","av_label":null,"av_matched":null,"av_total":null,"pid":"4720","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opened the service control manager"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads system information using Windows Management Instrumentation Commandline (WMIC)"],"informative_identifiers_count":2,"informative_identifiers":["Executes WMI queries","Contains references to WMI/WMIC"],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attck_id":"T1060","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies auto-execute functionality by setting/creating a value in the registry"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Writes data to a remote process","Allocates virtual memory in a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Writes data to a remote process","Allocates virtual memory in a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":1,"malicious_identifiers":["Deletes volume snapshots (often used by ransomware)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Reads information about supported languages","Queries sensitive IE security settings","Reads the active computer name"],"informative_identifiers_count":2,"informative_identifiers":["Reads the registry for installed applications","Reads the cryptographic machine GUID"],"parent":null},{"tactic":"Discovery","technique":"Network Service Scanning","attck_id":"T1046","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Detected increased number of ARP broadcast requests (network device lookup)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","malicious_identifiers_count":1,"malicious_identifiers":["Detected a large number of ARP broadcast requests (network device lookup)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Checks network status using ping"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null}],"network_mode":"tor","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00025650-00001304-00000033-5791325877\n \"vssadmin.exe\" at 00025713-00003488-00000033-9424189065\n \"WMIC.exe\" at 00025853-00003052-00000033-17839738473","description_v2":["\"vssadmin.exe\" at 00025650-00001304-00000033-5791325877","\"vssadmin.exe\" at 00025713-00003488-00000033-9424189065","\"WMIC.exe\" at 00025853-00003052-00000033-17839738473"],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" at 00025650-00001304-00000033-5791325877"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" at 00025713-00003488-00000033-9424189065"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" at 00025853-00003052-00000033-17839738473"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-56","type":6,"relevance":10,"name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","description_v2":["\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\""],"description_v3":[{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\""}],"origin":"API Call","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","\"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"iplo.ru\"\n \"isrg.trustid.ocsp.identrust.com\"\n \"ocsp.int-x3.letsencrypt.org\"","description_v2":["\"iplo.ru\"","\"isrg.trustid.ocsp.identrust.com\"","\"ocsp.int-x3.letsencrypt.org\""],"description_v3":[{"type":"text","value":"\"iplo.ru\""},{"type":"linebreak"},{"type":"text","value":"\"isrg.trustid.ocsp.identrust.com\""},{"type":"linebreak"},{"type":"text","value":"\"ocsp.int-x3.letsencrypt.org\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"88.99.66.31:443\"","description_v2":["\"88.99.66.31:443\""],"description_v3":[{"type":"text","value":"\"88.99.66.31:443\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"WMIC.pdb\"","description_v2":["\"WMIC.pdb\""],"description_v3":[{"type":"text","value":"\"WMIC.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"XO1XADpO01\"\n \"\\Sessions\\1\\BaseNamedObjects\\XO1XADpO01\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"XO1XADpO01\"","\"\\Sessions\\1\\BaseNamedObjects\\XO1XADpO01\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"XO1XADpO01\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\XO1XADpO01\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$26","description_v2":["\"\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")","\"\" touched \"Recycle Bin\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")","\"\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"\" touched \"Network\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")","\"\" touched \"Control Panel\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SHELLFOLDER\")","\"\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")","\"\" touched \"UsersLibraries\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\\SHELLFOLDER\")","\"\" touched \"CLSID_SearchFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{04731B67-D933-450A-90E6-4ACD2E9408FE}\\SHELLFOLDER\")","\"\" touched \"IE History and Feeds Shell Data Source for Windows Search\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{11016101-E366-4D22-BC06-4ADA335C892B}\\SHELLFOLDER\")","\"\" touched \"Public Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\\SHELLFOLDER\")","\"\" touched \"Control Panel command object for Start menu and desktop\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\\SHELLFOLDER\")","\"\" touched \"@%systemroot%\\system32\\mssvp.dll,-110\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{89D83576-6BD1-4C86-9454-BEB04E94C819}\\SHELLFOLDER\")","\"\" touched \"CLSID_SearchHome\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{9343812E-1C37-4A49-A12E-4B2D810D956B}\\SHELLFOLDER\")","\"\" touched \"Other Users Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\\SHELLFOLDER\")","\"\" touched \"@%systemroot%\\system32\\mssvp.dll,-112\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\\SHELLFOLDER\")","\"\" touched \"CLSID_StartMenuProviderFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\\SHELLFOLDER\")","\"\" touched \"CLSID_StartMenuPathCompleteProviderFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{E345F35F-9397-435C-8F95-4E922C26259E}\\SHELLFOLDER\")","\"\" touched \"Games Explorer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\\SHELLFOLDER\")","\"\" touched \"Computers and Devices\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\SHELLFOLDER\")","\"\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"],"description_v3":[{"type":"text","value":"\"\" touched \"Copy/Move/Rename/Delete/Link Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{3AD05575-8857-4850-9277-11B85BDB8E09}\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Recycle Bin\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\DEFAULTICON\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Network\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Control Panel\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"UsersLibraries\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"CLSID_SearchFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{04731B67-D933-450A-90E6-4ACD2E9408FE}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"IE History and Feeds Shell Data Source for Windows Search\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{11016101-E366-4D22-BC06-4ADA335C892B}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Public Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Control Panel command object for Start menu and desktop\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"@%systemroot%\\system32\\mssvp.dll,-110\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{89D83576-6BD1-4C86-9454-BEB04E94C819}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"CLSID_SearchHome\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{9343812E-1C37-4A49-A12E-4B2D810D956B}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Other Users Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"@%systemroot%\\system32\\mssvp.dll,-112\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"CLSID_StartMenuProviderFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"CLSID_StartMenuPathCompleteProviderFolder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{E345F35F-9397-435C-8F95-4E922C26259E}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Games Explorer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Computers and Devices\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"$27","description_v2":["Process \"vssadmin.exe\" (UID: 00025650-00001304) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"vssadmin.exe\" (UID: 00025650-00001304) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","Process \"vssadmin.exe\" (UID: 00025713-00003488) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"vssadmin.exe\" (UID: 00025713-00003488) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"WMIC.exe\" (UID: 00025853-00003052) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"WMIC.exe\" (UID: 00025853-00003052) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","Process \"bcdedit.exe\" (UID: 00025859-00001892) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"bcdedit.exe\" (UID: 00025859-00001892) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"bcdedit.exe\" (UID: 00026262-00002348) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"bcdedit.exe\" (UID: 00026262-00002348) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","Process \"cmd.exe\" (UID: 00034246-00004680) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"cmd.exe\" (UID: 00034246-00004680) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""],"description_v3":[{"type":"text","value":"Process \"vssadmin.exe\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"vssadmin.exe\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""},{"type":"linebreak"},{"type":"text","value":"Process \"vssadmin.exe\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"vssadmin.exe\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""},{"type":"linebreak"},{"type":"text","value":"Process \"bcdedit.exe\""},{"type":"process","process_uid":"00025859-00001892","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"bcdedit.exe\""},{"type":"process","process_uid":"00025859-00001892","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"bcdedit.exe\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"bcdedit.exe\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00034246-00004680","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00034246-00004680","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"\"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" on 2019-12-3.17:41:22.266\n \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" on 2019-12-3.17:46:57.188","description_v2":["\"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" on 2019-12-3.17:41:22.266","\"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" on 2019-12-3.17:46:57.188"],"description_v3":[{"type":"text","value":"\"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" on 2019-12-3.17:41:22.266"},{"type":"linebreak"},{"type":"text","value":"\"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" on 2019-12-3.17:46:57.188"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\" (UID: 00025643-00001776)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)\n Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00025859-00001892)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" (UID: 00034246-00004680)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\" (UID: 00025643-00001776)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)","Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)","Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00025859-00001892)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)","Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" (UID: 00034246-00004680)","Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\""},{"type":"process","process_uid":"00025643-00001776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\""},{"type":"process","process_uid":"00025859-00001892","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\""},{"type":"process","process_uid":"00034246-00004680","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\""},{"type":"process","process_uid":"00034335-00004720","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\" (UID: 00025643-00001776)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)\n Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00025859-00001892)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)\n Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" (UID: 00034246-00004680)\n Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\" (UID: 00025643-00001776)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)","Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)","Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00025859-00001892)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)","Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" (UID: 00034246-00004680)","Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete ...\""},{"type":"process","process_uid":"00025643-00001776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\""},{"type":"process","process_uid":"00025859-00001892","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\""},{"type":"process","process_uid":"00034246-00004680","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\""},{"type":"process","process_uid":"00034335-00004720","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\"\" connecting to \"\\ThemeApiPort\"","\"WMIC.exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"resultlog6.reg\" has type \"data\"\n \"resultlog6.reg\" has type \"empty\"\n \"A62FD562AB6FC89C4B2A8A0110748922\" has type \"data\"\n \"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08\" has type \"data\"\n \"1LJjq7_1_.png\" has type \"PNG image data 1 x 1 1-bit colormap non-interlaced\"","description_v2":["\"resultlog6.reg\" has type \"data\"","\"resultlog6.reg\" has type \"empty\"","\"A62FD562AB6FC89C4B2A8A0110748922\" has type \"data\"","\"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08\" has type \"data\"","\"1LJjq7_1_.png\" has type \"PNG image data 1 x 1 1-bit colormap non-interlaced\""],"description_v3":[{"type":"text","value":"\"resultlog6.reg\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"resultlog6.reg\" has type \"empty\""},{"type":"linebreak"},{"type":"text","value":"\"A62FD562AB6FC89C4B2A8A0110748922\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08\" has type \"data\""},{"type":"linebreak"},{"type":"text","value":"\"1LJjq7_1_.png\" has type \"PNG image data 1 x 1 1-bit colormap non-interlaced\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","\"\" touched file \"C:\\Windows\\SysWOW64\\ieframe.dll\"","\"\" touched file \"C:\\Windows\\SysWOW64\\en-US\\ieframe.dll.mui\"","\"\" touched file \"C:\\Windows\\System32\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\"","\"\" touched file \"C:\\Windows\\System32\\cmd.exe\"","\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"\" touched file \"C:\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\""],"description_v3":[{"type":"text","value":"\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\SysWOW64\\ieframe.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\SysWOW64\\en-US\\ieframe.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\cmd.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":3,"name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Pinging 1.1.1.1\"\n Heuristic match: \"Reply from 1.1.1.1:\"\n Heuristic match: \"Ping statistics for 1.1.1.1:\n Packets: Sent = 20, Received = 20, Lost = 0 (0% loss),\"\n Heuristic match: \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\"\n Heuristic match: \"ping 1.1.1.1 -n 20\"","description_v2":["Heuristic match: \"Pinging 1.1.1.1\"","Heuristic match: \"Reply from 1.1.1.1:\"","Heuristic match: \"Ping statistics for 1.1.1.1:","Packets: Sent = 20, Received = 20, Lost = 0 (0% loss),\"","Heuristic match: \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\"","Heuristic match: \"ping 1.1.1.1 -n 20\""],"description_v3":[{"type":"text","value":"Heuristic match: \"Pinging 1.1.1.1\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"Reply from 1.1.1.1:\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"Ping statistics for 1.1.1.1:"},{"type":"linebreak"},{"type":"text","value":"Packets: Sent = 20, Received = 20, Lost = 0 (0% loss),\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ping 1.1.1.1 -n 20\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"Pattern match: \"iplo.ru/1LJjq7.txt\"\n Pattern match: \"https://iplo.ru/1LJjq7.txt\"\n Heuristic match: \"iplo.ru\"\n Heuristic match: \"isrg.trustid.ocsp.identrust.com\"\n Heuristic match: \"ocsp.int-x3.letsencrypt.org\"","description_v2":["Pattern match: \"iplo.ru/1LJjq7.txt\"","Pattern match: \"https://iplo.ru/1LJjq7.txt\"","Heuristic match: \"iplo.ru\"","Heuristic match: \"isrg.trustid.ocsp.identrust.com\"","Heuristic match: \"ocsp.int-x3.letsencrypt.org\""],"description_v3":[{"type":"text","value":"Pattern match: \"iplo.ru/1LJjq7.txt\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://iplo.ru/1LJjq7.txt\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iplo.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"isrg.trustid.ocsp.identrust.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ocsp.int-x3.letsencrypt.org\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-30","type":2,"relevance":10,"name":"Contains references to WMI/WMIC","description":"\"wmic.exe SHADOWCOPY /nointeractive\" (Indicator: \"wmic.exe\")\n \"WMIC.exe\" (Indicator: \"wmic.exe\")\n \"root\\cimv2\" (Indicator: \"root\\cimv2\")","description_v2":["\"wmic.exe SHADOWCOPY /nointeractive\" (Indicator: \"wmic.exe\")","\"WMIC.exe\" (Indicator: \"wmic.exe\")","\"root\\cimv2\" (Indicator: \"root\\cimv2\")"],"description_v3":[{"type":"text","value":"\"wmic.exe SHADOWCOPY /nointeractive\" (Indicator: \"wmic.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Indicator: \"wmic.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\"\" opened \"\\Device\\KsecDD\"","\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","\"WMIC.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00025321-00001596-00000033-5947661851","description_v2":["\"\" queried SystemProcessInformation at 00025321-00001596-00000033-5947661851"],"description_v3":[{"type":"text","value":"\"\" queried SystemProcessInformation at 00025321-00001596-00000033-5947661851"}],"origin":"API Call","attck_id":"T1057","capec_id":"CAPEC-573","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":10,"name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.20714410425","description_v2":[".rdata with unusual entropies 7.20714410425"],"description_v3":[{"type":"text","value":".rdata with unusual entropies 7.20714410425"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"string-1","type":2,"relevance":4,"name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmware-usbarbitaQBCFMonitorServiIntuit.QuickBookvmware-converterhttps://iplo.ru/1LJjq7.txt\" (Indicator: \"vmware\")\n \"vmware-usbarbitator64\" (Indicator: \"vmware\")\n \"vmware-converter\" (Indicator: \"vmware\")","description_v2":["\"vmware-usbarbitaQBCFMonitorServiIntuit.QuickBookvmware-converterhttps://iplo.ru/1LJjq7.txt\" (Indicator: \"vmware\")","\"vmware-usbarbitator64\" (Indicator: \"vmware\")","\"vmware-converter\" (Indicator: \"vmware\")"],"description_v3":[{"type":"text","value":"\"vmware-usbarbitaQBCFMonitorServiIntuit.QuickBookvmware-converterhttps://iplo.ru/1LJjq7.txt\" (Indicator: \"vmware\")"},{"type":"linebreak"},{"type":"text","value":"\"vmware-usbarbitator64\" (Indicator: \"vmware\")"},{"type":"linebreak"},{"type":"text","value":"\"vmware-converter\" (Indicator: \"vmware\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"PING.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-6","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"http://isrg.trustid.ocsp.identrust.com\" as malicious (1% detection rate)","description_v2":["1/71 reputation engines marked \"http://isrg.trustid.ocsp.identrust.com\" as malicious (1% detection rate)"],"description_v3":[{"type":"text","value":"1/71 reputation engines marked \"http://isrg.trustid.ocsp.identrust.com\" as malicious (1% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-77","type":6,"relevance":10,"name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","description_v2":["\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)"],"description_v3":[{"type":"text","value":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)"},{"type":"linebreak"},{"type":"text","value":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)"}],"origin":"API Call","attck_id":"T1035","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","description_v2":["\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"registry-0","type":3,"relevance":8,"name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"XO1XADPO01\"; Value: \"\"C\"\")","description_v2":["\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"XO1XADPO01\"; Value: \"\"C\"\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"XO1XADPO01\"; Value: \"\"C\"\")"}],"origin":"Registry Access","attck_id":"T1060","capec_id":"CAPEC-270","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-32","type":7,"relevance":10,"name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.165/32, 192.168.240.166/32, 192.168.240.211/32, 192.168.240.213/32, 192.168.240.215/32, 192.168.240.217/32, 192.168.240.218/31, 192.168.240.220/31, 192.168.240.227/32, 192.168.240.230/32, 192.168.240.240/32, 192.168.240.242/31, 192.168.240.244/30, 192.168.240.249/32, ...\"","description_v2":["Attempt to find devices in networks: \"192.168.240.165/32, 192.168.240.166/32, 192.168.240.211/32, 192.168.240.213/32, 192.168.240.215/32, 192.168.240.217/32, 192.168.240.218/31, 192.168.240.220/31, 192.168.240.227/32, 192.168.240.230/32, 192.168.240.240/32, 192.168.240.242/31, 192.168.240.244/30, 192.168.240.249/32, ...\""],"description_v3":[{"type":"text","value":"Attempt to find devices in networks: \"192.168.240.165/32, 192.168.240.166/32, 192.168.240.211/32, 192.168.240.213/32, 192.168.240.215/32, 192.168.240.217/32, 192.168.240.218/31, 192.168.240.220/31, 192.168.240.227/32, 192.168.240.230/32, 192.168.240.240/32, 192.168.240.242/31, 192.168.240.244/30, 192.168.240.249/32, ...\""}],"origin":"Network Traffic","attck_id":"T1046","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-23","type":7,"relevance":5,"name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 88.99.66.31 on port 443 is sent without HTTP header","description_v2":["TCP traffic to 88.99.66.31 on port 443 is sent without HTTP header"],"description_v3":[{"type":"text","value":"TCP traffic to 88.99.66.31 on port 443 is sent without HTTP header"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-13","type":2,"relevance":7,"name":"Detected indicator that file is ransomware","description":"$29","description_v2":["\"All your important files are encrypted!","There is only one way to get your files back:","1. Contact with us","2. Send us 1 any encrypted your file and your personal key","3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files","4. Pay","5. We send for you decryptor software","","We accept Bitcoin","","Attention!","Do not rename encrypted files.","Do not try to decrypt using third party software, it may cause permanent data loss.","Decryption of your files with the help of third parties may cause increased price(they add their fee to our)","","Contact information: abcd-help@countermail.com","","Be sure to duplicate your message on the e-mail: supportpc@cock.li","","Your personal id:\" (Source: Ricks75.exe.bin, Indicator: \"decrypt your files\")","\"All your important files are encrypted!","There is only one way to get your files back:","1. Contact with us","2. Send us 1 any encrypted your file and your personal key","3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can dec\" (Source: 00025321-00001596-00000005-20784608717, Indicator: \"files are encrypted\")"],"description_v3":[{"type":"text","value":"\"All your important files are encrypted!"},{"type":"linebreak"},{"type":"text","value":"There is only one way to get your files back:"},{"type":"linebreak"},{"type":"text","value":"1. Contact with us"},{"type":"linebreak"},{"type":"text","value":"2. Send us 1 any encrypted your file and your personal key"},{"type":"linebreak"},{"type":"text","value":"3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files"},{"type":"linebreak"},{"type":"text","value":"4. Pay"},{"type":"linebreak"},{"type":"text","value":"5. We send for you decryptor software"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"We accept Bitcoin"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Attention!"},{"type":"linebreak"},{"type":"text","value":"Do not rename encrypted files."},{"type":"linebreak"},{"type":"text","value":"Do not try to decrypt using third party software, it may cause permanent data loss."},{"type":"linebreak"},{"type":"text","value":"Decryption of your files with the help of third parties may cause increased price(they add their fee to our)"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Contact information: abcd-help@countermail.com"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Be sure to duplicate your message on the e-mail: supportpc@cock.li"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Your personal id:\" (Source: Ricks75.exe.bin, Indicator: \"decrypt your files\")"},{"type":"linebreak"},{"type":"text","value":"\"All your important files are encrypted!"},{"type":"linebreak"},{"type":"text","value":"There is only one way to get your files back:"},{"type":"linebreak"},{"type":"text","value":"1. Contact with us"},{"type":"linebreak"},{"type":"text","value":"2. Send us 1 any encrypted your file and your personal key"},{"type":"linebreak"},{"type":"text","value":"3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can dec\" (Source: 00025321-00001596-00000005-20784608717, Indicator: \"files are encrypted\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"target-22","type":9,"relevance":5,"name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)","description_v2":["Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)"],"description_v3":[{"type":"text","value":"Process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\""},{"type":"process","process_uid":"00034335-00004720","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1018","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"target-10","type":9,"relevance":3,"name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","description_v2":["Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)"],"description_v3":[{"type":"text","value":"Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"$2a","description_v2":["\"\" opened \"C:\\Program Files\\7-Zip\\7zCon.sfx\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\descript.ion\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\7z.sfx\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\History.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\af.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\an.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\ar.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\az.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\ba.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\be.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\cy.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\el.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\eo.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\es.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\cs.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\et.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\eu.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fa.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fr.txt\" with delete access","\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fur.txt\" with delete access"],"description_v3":[{"type":"text","value":"\"\" opened \"%PROGRAMFILES%\\7-Zip\\7zCon.sfx\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\descript.ion\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\7z.sfx\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\History.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\af.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\an.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\ar.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\az.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\ba.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\be.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\cy.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\el.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\eo.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\es.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\cs.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\et.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\eu.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fa.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fr.txt\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\Program Files\\7-Zip\\Lang\\fur.txt\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","description_v2":["\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegDeleteValueW\n RegCreateKeyExW\n IcmpSendEcho\n CreateToolhelp32Snapshot\n GetDriveTypeW\n Process32First\n GetModuleFileNameW\n GetVersionExA\n GetFileAttributesW\n LoadLibraryA\n OpenProcess\n GetCommandLineW\n Process32Next\n GetProcAddress\n GetFileSizeEx\n CreateThread\n GetModuleHandleA\n FindNextFileW\n WriteFile\n GetComputerNameA\n ExitThread\n FindFirstFileExW\n TerminateProcess\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n NetShareEnum\n ShellExecuteExW\n WSAStartup\n URLDownloadToFileA","description_v2":["RegCloseKey","OpenProcessToken","RegDeleteValueW","RegCreateKeyExW","IcmpSendEcho","CreateToolhelp32Snapshot","GetDriveTypeW","Process32First","GetModuleFileNameW","GetVersionExA","GetFileAttributesW","LoadLibraryA","OpenProcess","GetCommandLineW","Process32Next","GetProcAddress","GetFileSizeEx","CreateThread","GetModuleHandleA","FindNextFileW","WriteFile","GetComputerNameA","ExitThread","FindFirstFileExW","TerminateProcess","CreateFileW","CreateProcessW","Sleep","GetTickCount","NetShareEnum","ShellExecuteExW","WSAStartup","URLDownloadToFileA"],"description_v3":[{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"OpenProcessToken"},{"type":"linebreak"},{"type":"text","value":"RegDeleteValueW"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExW"},{"type":"linebreak"},{"type":"text","value":"IcmpSendEcho"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"Process32First"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"GetVersionExA"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"OpenProcess"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"Process32Next"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"GetFileSizeEx"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameA"},{"type":"linebreak"},{"type":"text","value":"ExitThread"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessW"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"GetTickCount"},{"type":"linebreak"},{"type":"text","value":"NetShareEnum"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExW"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"},{"type":"linebreak"},{"type":"text","value":"URLDownloadToFileA"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"$2b","description_v2":["\"\" wrote bytes \"d83a2f75\" to virtual address \"0x75300274\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"c0dfa5771cf9a477ccf8a4770d64a67700000000c011467500000000fc3e467500000000e0134675000000009457547725e0a577c6e0a57700000000bc6a537700000000cf3146750000000093195477000000002c32467500000000\" to virtual address \"0x76251000\" (part of module \"NSI.DLL\")","\"\" wrote bytes \"0efca87781eda777ae86a677c6e0a577effda8772d16a777c0fca477da8faf776014a977478da677a8e2a5776089a67700000000ad37d8758b2dd875b641d87500000000\" to virtual address \"0x73851000\" (part of module \"WSHIP6.DLL\")","\"\" wrote bytes \"b4360200\" to virtual address \"0x752F4D68\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"d83a2f75\" to virtual address \"0x75300258\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"b4362f75\" to virtual address \"0x75300278\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"b4360200\" to virtual address \"0x752F4EA4\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"b4362f75\" to virtual address \"0x7530025C\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"d83a2f75\" to virtual address \"0x753001FC\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"d83a2f75\" to virtual address \"0x753001E0\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"b4362f75\" to virtual address \"0x75300200\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"b83012a373ffe0\" to virtual address \"0x75D81368\" (part of module \"WS2_32.DLL\")","\"\" wrote bytes \"6012a373\" to virtual address \"0x73F94028\" (part of module \"WEBIO.DLL\")","\"\" wrote bytes \"6012a373\" to virtual address \"0x7616E324\" (part of module \"WININET.DLL\")","\"\" wrote bytes \"b4362f75\" to virtual address \"0x753001E4\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"711139027a3b3802ab8b02007f950200fc8c0200729602006cc805001ecd35027d263502\" to virtual address \"0x757207E4\" (part of module \"USER32.DLL\")","\"\" wrote bytes \"b84013a373ffe0\" to virtual address \"0x752F3AD8\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"d83a0200\" to virtual address \"0x752F4E38\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"d83a0200\" to virtual address \"0x752F4D78\" (part of module \"SSPICLI.DLL\")","\"\" wrote bytes \"68130000\" to virtual address \"0x75D81680\" (part of module \"WS2_32.DLL\")"],"description_v3":[{"type":"text","value":"\"\" wrote bytes \"d83a2f75\" to virtual address \"0x75300274\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"c0dfa5771cf9a477ccf8a4770d64a67700000000c011467500000000fc3e467500000000e0134675000000009457547725e0a577c6e0a57700000000bc6a537700000000cf3146750000000093195477000000002c32467500000000\" to virtual address \"0x76251000\" (part of module \"NSI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"0efca87781eda777ae86a677c6e0a577effda8772d16a777c0fca477da8faf776014a977478da677a8e2a5776089a67700000000ad37d8758b2dd875b641d87500000000\" to virtual address \"0x73851000\" (part of module \"WSHIP6.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4360200\" to virtual address \"0x752F4D68\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"d83a2f75\" to virtual address \"0x75300258\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4362f75\" to virtual address \"0x75300278\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4360200\" to virtual address \"0x752F4EA4\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4362f75\" to virtual address \"0x7530025C\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"d83a2f75\" to virtual address \"0x753001FC\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"d83a2f75\" to virtual address \"0x753001E0\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4362f75\" to virtual address \"0x75300200\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b83012a373ffe0\" to virtual address \"0x75D81368\" (part of module \"WS2_32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"6012a373\" to virtual address \"0x73F94028\" (part of module \"WEBIO.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"6012a373\" to virtual address \"0x7616E324\" (part of module \"WININET.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b4362f75\" to virtual address \"0x753001E4\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"711139027a3b3802ab8b02007f950200fc8c0200729602006cc805001ecd35027d263502\" to virtual address \"0x757207E4\" (part of module \"USER32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"b84013a373ffe0\" to virtual address \"0x752F3AD8\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"d83a0200\" to virtual address \"0x752F4E38\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"d83a0200\" to virtual address \"0x752F4D78\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"68130000\" to virtual address \"0x75D81680\" (part of module \"WS2_32.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthyness","identifier":"target-6","type":9,"relevance":8,"name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00025643-00001776)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)","description_v2":["Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00025643-00001776)","Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)"],"description_v3":[{"type":"text","value":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\""},{"type":"process","process_uid":"00025643-00001776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Environment Awareness","identifier":"binary-8","type":8,"relevance":5,"name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"Ricks75.exe.bin\" (Offset: 9835)","description_v2":["Found VM detection artifact \"CPUID trick\" in \"Ricks75.exe.bin\" (Offset: 9835)"],"description_v3":[{"type":"text","value":"Found VM detection artifact \"CPUID trick\" in \"Ricks75.exe.bin\" (Offset: 9835)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-20","type":6,"relevance":7,"name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"\n \"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\"","description_v2":["\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"","\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\""],"description_v3":[{"type":"text","value":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\""},{"type":"linebreak"},{"type":"text","value":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\""}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$2c","description_v2":["\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)","\"\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)","\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)","\"\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)"],"description_v3":[{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 2408)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 2408)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 400)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\PING.EXE\" (Handle: 132)"}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-31","type":7,"relevance":10,"name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.0/25, 192.168.240.128/26, 192.168.240.192/27, 192.168.240.224/28, 192.168.240.240/29, 192.168.240.248/30, 192.168.240.252/31, 192.168.240.254/32\"","description_v2":["Attempt to find devices in networks: \"192.168.240.0/25, 192.168.240.128/26, 192.168.240.192/27, 192.168.240.224/28, 192.168.240.240/29, 192.168.240.248/30, 192.168.240.252/31, 192.168.240.254/32\""],"description_v3":[{"type":"text","value":"Attempt to find devices in networks: \"192.168.240.0/25, 192.168.240.128/26, 192.168.240.192/27, 192.168.240.224/28, 192.168.240.240/29, 192.168.240.248/30, 192.168.240.252/31, 192.168.240.254/32\""}],"origin":"Network Traffic","attck_id":"T1016","capec_id":"CAPEC-309","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1016","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-21","type":7,"relevance":10,"name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","description_v2":["Found malicious artifacts related to \"88.99.66.31\": ...","","URL: http://iplogger.org/ (AV positives: 3/72 scanned on 12/03/2019 13:19:04)","URL: https://2no.co/20SBp.png (AV positives: 2/72 scanned on 12/03/2019 00:58:56)","URL: http://iplogger.org/1ax3r7 (AV positives: 3/71 scanned on 12/03/2019 05:21:42)","URL: https://2no.co/2kjcf5.zip (AV positives: 3/72 scanned on 12/03/2019 08:41:33)","URL: https://yip.su/2A2yA5 (AV positives: 4/71 scanned on 12/02/2019 21:10:22)","File SHA256: 25c60987a0148c19477196257478f14c584600acd742369cb8859256ff005400 (Date: 12/02/2019 19:44:27)","File SHA256: 54a32aca91c9e377199ac9741b224d5ee09dc4ac67f6177bb4e9f336e5d178b2 (Date: 12/02/2019 10:09:35)","File SHA256: 284fca96f27a66ed051896d2d4e4d4223bf13cb78f9ac93e4485690f552466f9 (Date: 12/02/2019 08:27:27)","File SHA256: 3080858d67dfa757fd27fa4dc3cfd521a8308b8698eeec6fb599fefd7903ef76 (Date: 12/01/2019 12:30:24)","File SHA256: bf91a306b6ab0b0c3aa967a3d75d695cd17f4657f79d701fae635a2b1370fea1 (Date: 12/01/2019 12:20:56)","File SHA256: b21eee65a4989045031d505f4815480af360fef439d3c8a33b4e25b2bae6417f (AV positives: 10/67 scanned on 11/27/2019 12:54:22)","File SHA256: 45ccc6cbb985349ce634514adbb78f40ea9c6ad254fb66a85d135d88b9ba6699 (AV positives: 8/73 scanned on 11/18/2019 13:08:15)","File SHA256: 973b0b17d797cff3efc339ada398171f17b694ca23ad142daabc2d3f0fa2a7e5 (AV positives: 17/72 scanned on 11/12/2019 11:12:13)","File SHA256: 776bc011b5cb042decafe43f2b584b0afe9da5c7b9d9ac6de81e885a7defbeaf (AV positives: 28/73 scanned on 11/10/2019 08:31:29)","File SHA256: f6c5022df4d05e6440f8157eec277cd1908a2f7f3dfb4ccce99994d4d273ff1e (AV positives: 34/74 scanned on 11/07/2019 20:08:18)"],"description_v3":[{"type":"text","value":"Found malicious artifacts related to \"88.99.66.31\": ..."},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"URL: http://iplogger.org/ (AV positives: 3/72 scanned on 12/03/2019 13:19:04)"},{"type":"linebreak"},{"type":"text","value":"URL: https://2no.co/20SBp.png (AV positives: 2/72 scanned on 12/03/2019 00:58:56)"},{"type":"linebreak"},{"type":"text","value":"URL: http://iplogger.org/1ax3r7 (AV positives: 3/71 scanned on 12/03/2019 05:21:42)"},{"type":"linebreak"},{"type":"text","value":"URL: https://2no.co/2kjcf5.zip (AV positives: 3/72 scanned on 12/03/2019 08:41:33)"},{"type":"linebreak"},{"type":"text","value":"URL: https://yip.su/2A2yA5 (AV positives: 4/71 scanned on 12/02/2019 21:10:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 25c60987a0148c19477196257478f14c584600acd742369cb8859256ff005400 (Date: 12/02/2019 19:44:27)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 54a32aca91c9e377199ac9741b224d5ee09dc4ac67f6177bb4e9f336e5d178b2 (Date: 12/02/2019 10:09:35)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 284fca96f27a66ed051896d2d4e4d4223bf13cb78f9ac93e4485690f552466f9 (Date: 12/02/2019 08:27:27)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 3080858d67dfa757fd27fa4dc3cfd521a8308b8698eeec6fb599fefd7903ef76 (Date: 12/01/2019 12:30:24)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: bf91a306b6ab0b0c3aa967a3d75d695cd17f4657f79d701fae635a2b1370fea1 (Date: 12/01/2019 12:20:56)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: b21eee65a4989045031d505f4815480af360fef439d3c8a33b4e25b2bae6417f (AV positives: 10/67 scanned on 11/27/2019 12:54:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 45ccc6cbb985349ce634514adbb78f40ea9c6ad254fb66a85d135d88b9ba6699 (AV positives: 8/73 scanned on 11/18/2019 13:08:15)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 973b0b17d797cff3efc339ada398171f17b694ca23ad142daabc2d3f0fa2a7e5 (AV positives: 17/72 scanned on 11/12/2019 11:12:13)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 776bc011b5cb042decafe43f2b584b0afe9da5c7b9d9ac6de81e885a7defbeaf (AV positives: 28/73 scanned on 11/10/2019 08:31:29)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f6c5022df4d05e6440f8157eec277cd1908a2f7f3dfb4ccce99994d4d273ff1e (AV positives: 34/74 scanned on 11/07/2019 20:08:18)"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Pattern Matching","identifier":"yara-0","type":13,"relevance":10,"name":"YARA signature match","description":"YARA signature \"IMPLANT_4_v7\" classified file \"Ricks75.exe.bin\" as \"apt,apt28\" based on indicators: \"c745e075736572c745e433322e6466c745e86c6c,c7857cffffff61647661c7458070693332c745842e646c6c,c745a47368656cc745a86c33322ec745ac646c6c\" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, Author: US CERT)","description_v2":["YARA signature \"IMPLANT_4_v7\" classified file \"Ricks75.exe.bin\" as \"apt,apt28\" based on indicators: \"c745e075736572c745e433322e6466c745e86c6c,c7857cffffff61647661c7458070693332c745842e646c6c,c745a47368656cc745a86c33322ec745ac646c6c\" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, Author: US CERT)"],"description_v3":[{"type":"text","value":"YARA signature \"IMPLANT_4_v7\" classified file \"Ricks75.exe.bin\" as \"apt,apt28\" based on indicators: \"c745e075736572c745e433322e6466c745e86c6c,c7857cffffff61647661c7458070693332c745842e646c6c,c745a47368656cc745a86c33322ec745ac646c6c\" (Reference: https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE, Author: US CERT)"}],"origin":"YARA Signature","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Ransomware/Banking","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","description_v2":["Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)","Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)","Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Destruction","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","description_v2":["Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)","Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)","Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"$2e","description_v2":["Spawned process \"\" (UID: 00025321-00001596)","Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00025643-00001776)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00025650-00001304)","Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00025713-00003488)","Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00025853-00003052)","Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\" (UID: 00025859-00001892)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00026262-00002348)","Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\" (UID: 00034246-00004680)","Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\" (UID: 00034335-00004720)"],"description_v3":[{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00025321-00001596","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\""},{"type":"process","process_uid":"00025643-00001776","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00025650-00001304","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00025713-00003488","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\""},{"type":"process","process_uid":"00025853-00003052","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"/set {default} recoveryenabled No\""},{"type":"process","process_uid":"00025859-00001892","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00026262-00002348","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C ping 1.1.1.1 -n 20 > Nul & Del /f /q \"C:\\Ricks75.exe\"\""},{"type":"process","process_uid":"00034246-00004680","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PING.EXE\" with commandline \"ping 1.1.1.1 -n 20\""},{"type":"process","process_uid":"00034335-00004720","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":false,"network_mode":"tor","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Professional","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"8.30","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Ransomware","details":["Detected indicator that file is ransomware","Deletes volume snapshots (often used by ransomware)"]},{"name":"Spyware","details":["Deletes volume snapshots (often used by ransomware)"]},{"name":"Persistence","details":["Writes data to a remote process","Modifies auto-execute functionality by setting/creating a value in the registry","Spawns a lot of processes","Disables startup repair","Tries to suppress failures during boot (often used to hide system changes)"]},{"name":"Fingerprint","details":["Queries process information","Reads the active computer name","Queries sensitive IE security settings","Reads system information using Windows Management Instrumentation Commandline (WMIC)"]},{"name":"Evasive","details":["The input sample contains a known anti-VM trick","Possibly tries to implement anti-virtualization techniques","Checks network status using ping"]},{"name":"Spreading","details":["Detected a large number of ARP broadcast requests (network device lookup)"]},{"name":"Network Behavior","details":["Contacts 3 domains and 3 hosts"]}],"icon":"$2f","visualization":"$30","classification":["41.0% (.EXE) Win32 Executable MS Visual C++ (generic)","36.3% (.EXE) Win64 Executable (generic)","8.6% (.DLL) Win32 Dynamic Link Library (generic)","5.9% (.EXE) Win32 Executable (generic)","2.6% (.EXE) OS/2 Executable (generic)"],"dns_requests":[{"compromised":true,"domain":"iplo.ru","address":"88.99.66.31","ttl":3599,"country":"Germany","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"f18cdfa08f02af2ab190fd3cf3f0acae5fd30ed3aabd3151a8059209fdb0fd17","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-10-31T04:11:39+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/f18cdfa08f02af2ab190fd3cf3f0acae5fd30ed3aabd3151a8059209fdb0fd17/"}},{"sha256":"3870336a357f895dc708256a6f9eb8a0a6ba3d0636a1ab2f3294c03f1ceecf45","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-09-20T01:38:00+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/3870336a357f895dc708256a6f9eb8a0a6ba3d0636a1ab2f3294c03f1ceecf45/"}}]},{"compromised":false,"domain":"isrg.trustid.ocsp.identrust.com","address":"104.124.61.25","ttl":25,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:20:34+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe/"}},{"sha256":"da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:14:35+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd/"}},{"sha256":"00aa9d0a41cb9ff93585fdcf457fc5733c2519c7b8b655a8ff8704ac034551b7","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:08:01+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/00aa9d0a41cb9ff93585fdcf457fc5733c2519c7b8b655a8ff8704ac034551b7/"}},{"sha256":"c02b493d7c2a87c0be38487892745c3921d831ae393457a4df8af4e7fa6ecd41","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:07:59+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/c02b493d7c2a87c0be38487892745c3921d831ae393457a4df8af4e7fa6ecd41/"}},{"sha256":"5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:01:26+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9/"}}]},{"compromised":false,"domain":"ocsp.int-x3.letsencrypt.org","address":"104.124.61.26","ttl":7062,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":"Internet Security Research Group","registrar_name_servers":"A9-67.AKAM.NET","registrar_creation_date":"2014-07-07T19:54:04+00:00","who_is":[{"key":"Address","value":"331 E Evelyn Ave"},{"key":"City","value":"Mountain View"},{"key":"Country","value":"US"},{"key":"Creation Date","value":"Mon, 07 Jul 2014 19:54:04 GMT"},{"key":"DNSSEC","value":"unsigned"},{"key":"Domain Name","value":"LETSENCRYPT.ORG"},{"key":"EMail","value":"hostmaster@letsencrypt.org"},{"key":"Expiration Date","value":"Tue, 07 Jul 2020 19:54:04 GMT"},{"key":"name","value":"Josh Aas"},{"key":"Name Server","value":"A9-67.AKAM.NET"},{"key":"Name Server","value":"A14-64.AKAM.NET"},{"key":"Organization","value":"Internet Security Research Group"},{"key":"Reigstrar","value":"eNom, Inc."},{"key":"State","value":"CA"},{"key":"Status","value":"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"},{"key":"Last Update","value":"Thu, 01 Dec 2016 19:46:58 GMT"},{"key":"Zip Code","value":"94041"}],"associated_sha256s":[{"sha256":"c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:20:34+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe/"}},{"sha256":"da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:14:35+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd/"}},{"sha256":"5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:01:26+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9/"}},{"sha256":"b3b2a16701c7789915e312bc304282434a2f984045dacc150d73af6c76ba20c3","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:01:22+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/b3b2a16701c7789915e312bc304282434a2f984045dacc150d73af6c76ba20c3/"}},{"sha256":"dba8e3f90003f915b348f52bf990bfe57f5fb4ea9dc650a6f9a50320022bb045","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T15:49:13+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/dba8e3f90003f915b348f52bf990bfe57f5fb4ea9dc650a6f9a50320022bb045/"}}]}],"contacted_hosts":[{"compromised":true,"address":"88.99.66.31","port":443,"protocol":"TCP","associated_runtime":[{"name":"ricks75.exe","pid":"1596"}],"country":"Germany","associated_sha256s":[{"sha256":"c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:20:34+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/c1dce1793001c99ce1fef4134319a2087613ccccfe95a8fc7043638acee090fe/"}},{"sha256":"da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:14:35+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/da472fb249f533628a84ecf27faf9dc61bb76fe683c9373a5667b17a041b7ddd/"}},{"sha256":"5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:01:26+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/5da2050f7f13863ac856c1178c934b63975792f9d1c6f6be187e7e5b66dc99a9/"}},{"sha256":"b3b2a16701c7789915e312bc304282434a2f984045dacc150d73af6c76ba20c3","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T16:01:22+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/b3b2a16701c7789915e312bc304282434a2f984045dacc150d73af6c76ba20c3/"}},{"sha256":"dba8e3f90003f915b348f52bf990bfe57f5fb4ea9dc650a6f9a50320022bb045","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-12-03T15:49:13+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/dba8e3f90003f915b348f52bf990bfe57f5fb4ea9dc650a6f9a50320022bb045/"}}]}],"contacted_countries":{"countries":["DEU"],"coordinates":[{"origin":{"latitude":"34.0559","longitude":"-118.2666"},"destination":{"latitude":"52.4627","longitude":"13.5791"}}]},"port_infos":[{"port":443,"description":"Hypertext Transfer Protocol over TLS/SSL (HTTPS)"}],"extracted_strings":{"all":[{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkICVkIG9uIHBhdGggPSAiJVMi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkIDUgb24gcGF0aCA9ICJDOlxcRG9jdW1lbnRzIGFuZCBTZXR0aW5nc1wqIiA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhIUZpbmRDbG9zZSBmYWlsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhRmluZE5leHRGaWxlIGRpZWQgJWxkOyBwYXRoID0gIiVTIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IixubnV1bnkgUSBMIFE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkNJTVRZUEUiLCAwLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IldRTCIsTCJTRUxFQ1QgKiBGUk9NIE1TRlRfQ2xpVHJhbnNsYXRlVGFibGUiLFdCRU1fRkxBR19GT1JXQVJEX09OTFl8V0JFTV9GTEFHX1JFVFVSTl9JTU1FRElBVEVMWSxOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXNcYm9vdG1ncg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXNccmVzdWx0bG9nNi5yZWc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JmpMJjZabDY/QX4/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KiBGUk9NIE1TRlRfQ2xpVHJhbnNsYXRlVGFibGU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNIZWFwX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNYX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNhZmVJbnRFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LzFMSmpxNy50eHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L0MgcGluZyAxLjEuMS4xIC1uIDIwID4gTnVsICYgRGVsIC9mIC9xICJDOlxSaWNrczc1LmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdnNzYWRtaW4gZGVsZXRlIHNoYWRvd3MgL2FsbCAvcXVpZXQgJiB3bWljIHNoYWRvd2NvcHkgZGVsZXRlICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVzICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgbm8gJiB3YmFkbWluIGRlbGV0ZSBjYXRhbG9nIC1xdWlldA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDAuMTYzODU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ny1wUljDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ojpsb2FkKEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OkV4ZWNNZXRob2QoTCIlcyIsIEwiJXMiLCAwLCBOVUxMLCAtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9sZW5ndGgoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"O2QyMlZ0OjpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$31","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFycmF5IG9m","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFTU09DLk9CSkVDVEFSUkFZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBFTkQ+JXM8L0FQUEVORD48VVNFUj4lczwvVVNFUj48QUdHUkVHQVRFPiVzPC9BR0dSRUdBVEU+PC9DT05URVhUPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVtYmVkZWQgT2JqZWN0Pg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEhSRVNVTFQ+MHgleDwvSFJFU1VMVD4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PSYmakw2NlpsPz9Bfg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiVzPC9WQUxVRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PjwvYXNzZV/Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAQUVCVjBAQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCREBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xQ0hTdHJpbmdAQFFFQUFAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xZXhjZXB0aW9uQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlBP0FWQ0hTdHJpbmdAQEFFQlYwQFBFQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0VtcHR5QENIU3RyaW5nQEBRRUFBWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFFQkFIUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUVCQUhQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0Zvcm1hdEBDSFN0cmluZ0BAUUVBQVhQRUJHWlo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUVBQVBFQUdIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElFQkFQRUFVQ0hTdHJpbmdEYXRhQEBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFFQkE/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUVCQT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRRUJBP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3Rlcm1pbmF0ZUBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1MZWZ0QENIU3RyaW5nQEBRRUFBWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1SaWdodEBDSFN0cmluZ0BAUUVBQVhYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3doYXRAZXhjZXB0aW9uQEBVRUJBUEVCRFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WyUuMnU6JS4ydTolLjJ1XSAuICVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W1VOS05PV05d","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxDZFJvbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxGbG9wcHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxXYmVtXENJTU9N","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwNEVDLS0xNjA2MTczMTM2LTMxNTEyMzY2MTY2MDQzNjQzMTQ0NTc1NTMwMDEzNDY5NDc2MDYxODQ0MTEyNDk1Njk3NTA3NTQwMTI0MzM1MDQ2NQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwRDhDLS0xMTY3ODgyOTEtMTE4Njg2MTQzMi02NzY5MDM3MjUtODMwMDQ5NzAtMTc1MDA4MTE2NS0xMDI2ODI4MDA2LTE1MDQzNjcyMDAtNzU5MDczMjY5","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwREQwLTE3OTU3MTA3NjAtNjU0OTc5MTgwLTgxMjg1NDM1MS0xNzU1ODEyMTE4NjExMzYyMjk3LTE0NjIyNjQzODAyMjA5MzkwNTgxMDg0MTYwNzMy","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAxMjVDLS0xODM5Mjk1MzUxLTIwMjgxOTc4NDEtNDE4ODIzOTM4LTU2MTA5MzI0LTg1NTE5ODk4OC0xMDk3MTczMTEzMTQ3MDU1MTY1OC0xMzk4OTA0NDgz","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Xz0yIkYyLkYmbnU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Xz9fX19fX18wXz9sX19sX19fX19fcV9fPz9fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19DX3NwZWNpZmljX2hhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DbGFzcyA9ICAi","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19ERVJJVkFUSU9O","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxvbmV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NhbGxuZXdo","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2ZpbGVsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbnByaW50Zg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbndwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3dmcmVvcGVu","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YCQgNVvDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDMtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDQtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDctZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRmaWxlLnR4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWdOYW1lKEwiVkFMVUUiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxpZmllcnMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVj","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVjcnlwdCB5b3VyIGZpbGVzNC4gUGF5NS4gV2Ugc2VuZCBmb3IgeW91IGRlY3J5cHRvciBzb2Z0d2FyZVdlIGFjY2VwdCBCaXRjb2luQXR0ZW50aW9uIURvIG5vdCByZW5hbWUgZW5jcnlwdGVkIGZpbGVzLkRvIG5vdCB0cnkgdG8gZGVjcnlwdCB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuRGVjcnlwdGlvbiBvZiB5b3VyIGZpbGVzIHdpdGggdGhlIGhlbHAgb2YgdGhpcmQgcGFydGllcyBtYXkgY2F1c2UgaW5jcmVhc2VkICBwcmljZSh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKUNvbnRhY3QgaW5mb3JtYXRpb246IGFiY2QtaGVscEBjb3VudGVybWFpbC5jb21CZSBzdXJlIHRvIGR1cGxpY2F0ZSB5b3VyIG1lc3NhZ2Ugb24gdGhlIGUtbWFpbDogc3VwcG9ydHBjQGNvY2subGlZb3VyIHBlcnNvbmFsIGlkOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwcm94aW1hdGUgcm91bmQgdHJpcCB0aW1lcyBpbiBtaWxsaS1zZWNvbmRzOiAgICBNaW5pbXVtID0gMW1zLCBNYXhpbXVtID0gLTM5NDZtcywgQXZlcmFnZSA9IDIxNDc0NDgwMG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NDTEFTUw==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRlOjpwdXRyZWZfc3R5bGVzaGVldCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRzIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlKEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXduSW5zdGFuY2UoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFuZyBEw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIlRleHQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkRlbGV0ZUNsYXNzKEwiJXMiLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkdldE9iamVjdChMIiVzIiwgV0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmluZGVsc2VzcG4=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJ1a0dvbmdlciUmbg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZXM9MzI=","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcYmFkcGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0QgQnVybmluZw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclRvT2VtQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q0xJUEJPQVJE","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VTZXJ2aWNlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZExpbmVUb0FyZ3ZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFByb2dyYW1z","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0IE1lbnU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uUGljdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVmlkZW8=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb24gRXJyb3IgKHRoZSBlcnJvcmxldmVsIGlzIHV0aWxpdHkgc3BlY2lmaWMp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dExpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbFNlcnZpY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycmV1dG9zOmnDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2VsbEtub3duU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZW5SYW5kb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIl9fUkVMUEFUSCIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkF1dGhvcml0eSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkZvcm1hdCIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIlByb3BlcnRpZXMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldE5hbWVzKE5VTEwsIFdCRU1fRkxBR19BTFdBWVMgfCBXQkVNX0ZMQUdfTk9OU1lTVEVNX09OTFksIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3RvcjzDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3Vsc2VydmVy","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RCIiZlQqKn47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YSBCdWZmZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFRUTA==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2F0Y2g=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlIFNoYWRvd3MgL0FsbCAvUXVpZXQ=","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVyaXZhdGlvbiIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG8gRGlyZXQ=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RE9NRG9jdW1lbnQyOjpjcmVhdGVEb2N1bWVudEZyYWdtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Z2V0X3BhcmVudE5vZGUoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZSBkaSBtw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Y2xvbmVOb2RlKFZBUklBTlRfVFJVRSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWROb2RlTWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlT2JqZWN0VmFsaWRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHJpdmF0ZU9iamVjdEhlYXA=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5kP3rDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURlcGVuZGVudFNlcnZpY2VzQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJJVkFUSU9OPiVzPC9ERVJJVkFUSU9OPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVNDUklQVElPTj4iVW5rbm93biBXQkVNIEVycm9yIjwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXROYW1lZEl0ZW0oLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwXGRpcjAwMDAuY2hrIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcCA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcFxMYW5nIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcREVTSUdORVIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxDbGlja1RvUnVuIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxEVyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTlwxMDMzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFVVJPIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxGaWx0ZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxHUlBIRkxUIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxIZWxwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYXItU0EgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYmctQkcgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcY3MtQ1ogOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGEtREsgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGUtREUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZWwtR1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZW4tVVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXMtRVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXQtRUUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZmktRkkgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnItRlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9ucyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xudW1iZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51IDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1x3ZWIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaGUtSUwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHItSFIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHUtSFUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcSFdSQ3VzdG9taXphdGlvbiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaXQtSVQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcamEtSlAgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtca28tS1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHQtTFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHYtTFYgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmItTk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmwtTkwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccGwtUEwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtQlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtUFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccm8tUk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccnUtUlUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2stU0sgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2wtU0kgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkFJTDogJXM=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmF2b3JpdGVz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RkYiKm5ubm55biBOIEwgTg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RklOSVRFLCAxLC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRhcHRlcnNBZGRyZXNzZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aGVyZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGZvcm0ueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9pcGxvLnJ1LzFMSmpxNy50eHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWNcZXhlY2VuZ2luZS5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZTZW5kRWNobzI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENyZWF0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcFNlbmRFY2hv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpZmllckxpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWVmcmFtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1QRVJTT05BVEU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQb3BFbnRyeVNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50dWl0LlF1aWNrQm9va3MuRkNT","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBtYXAvc2V0PFQ+IGl0ZXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBwYXJhbWV0ZXIgcGFzc2VkIHRvIEMgcnVudGltZSBmdW5jdGlvbi4=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVBITFBBUEkuRExM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXBsby5ydQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":66},{"value":"aXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":71},{"value":"aXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNUZXh0UGxhaW5Ib25vcmVk","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXRvNifDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVRZQ09ERT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXp6b2hlw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SiUlb1wuLnI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"akwmJlpsNjZBfj8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a2FzIChKdW5jPcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VhciBmb2FyYmVpOmp8w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TCIlcyIsIEwiJXMiLCAqLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TCYmamw2Nlp+Pz9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuU2VydmVy","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGFzdEVudW0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGQoLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGRyRW51bWVyYXRlTG9hZGVkTW9kdWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TEVDVCAqIEZST00=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TElUWUNPREU+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE1ET01BSU46","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nIEZpbGUgTWF4IFNpemU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcGlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcGlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TFQsIFJQQ19DX0FVVEhaX05PTkUsIE5VTEwsICVkLCAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHRhUGFzaTp3LHXDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwc3BsaXRzaW5nw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4IFNpemU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FwYWNpdHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJDb25uZWN0aW9uIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJEZWZhdWx0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJQcm9wZXJ0aWVzIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJWZXJiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpQdXQoTCIlcyIsIDAsIC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVtbW92ZV9z","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEJhc2UgQ3J5cHRvZ3JhcGhpYyBQcm92aWRlciB2MS4w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OmNyZWF0ZUNEQVRBU2VjdGlvbigtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OnNhdmUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpwdXRfdGV4dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUxvY2F0b3I6OkNvbm5lY3RTZXJ2ZXIoTCIlcyIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bU1pY3Jvc29mdCBCYXNlIENyeXB0b2dyYXBoaWMgUHJvdmlkZXIgdjEuMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDguMC4wOyBTTS1HOTYwRiBCdWlsZC9SMTZOVykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzYyLjAuMzIwMi44NCBNb2JpbGUgU2FmYXJpLzUzNy4zNg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bVNlcnZpY2VzOjpQdXRJbnN0YW5jZSgtLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1I5MC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TXkgUGljdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXkgVmlkZW8=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZShMIlJFQ09SRCIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TkFNRVNQQUNF","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkNFTlVNPSIlZCIgSVNTVUVERlJPTT0iJXMiIFNUQVJUVElNRT0iJXMiIEVWRVJZQ09VTlQ9IiVkIj4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmQgb2YgZG9jX0bDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmQgb2bDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmU6ICU2ZCBGaWxlOiAlcw==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmVyIFZlcmJpbjZEw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkVUQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0QXBpQnVmZmVyRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0U2hhcmVFbnVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0V2tzdGFHZXRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmllIGthdGFsw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tk9JTlRFUkFDVElWRQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEZvdW5k","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEltcGxlbWVudGVk","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TnRBbGxvY2F0ZVZpcnR1YWxNZW1vcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TnVrZU9uRGVsZXRl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXQoTCJTZXJ2ZXIiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXRQcm9wZXJ0eVF1YWxpZmllclNldChMIiVzIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0JKRUNUQVJSQVk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0TGltaXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2NodF7Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":71},{"value":"T0RFPSIlcyI+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b21tYW5kbGluZSBVdGlsaXR5","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3Blbk11dGV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNDTWFuYWdlckE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNlcnZpY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1BFUlRZQ09VTlQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1I+PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj48L0VSUk9SPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3VuZC4gQ29ubmVjdGluZyB0byBtc180MDkiLCBOVUxMLCBOVUxMLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFzc2Fkw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGF0aEFkZEJhY2tzbGFzaFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aEZpbmRFeHRlbnNpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUJhY2tzbGFzaFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUV4dGVuc2lvbkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUZpbGVTcGVjVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UENfQ19BVVRITl9HU1NfS0VSQkVST1MsUlBDX0NfQVVUSFpfTk9ORSwgJXMsICVkLCAgICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cGluZyAgMS4xLjEuMSAtbiAyMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"PING.EXE","compromised":null,"detection_total":null,"total":null},{"value":"UGluZyBzdGF0aXN0aWNzIGZvciAxLjEuMS4xOiAgICBQYWNrZXRzOiBTZW50ID0gMjAsIFJlY2VpdmVkID0gMjAsIExvc3QgPSAwICgwJSBsb3NzKSw=","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluZ2luZyAxLjEuMS4x","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJPQ19TRVJWRVIsIDAsIDEsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbURhdGE=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJDRk1vbml0b3JTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJJRFBTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlTZXJ2aWNlU3RhdHVzRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ci5PJ3RrZW4t","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFiYXdfU8Ovwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFtZXRlcnMiLDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmM6OkdldFRleHQoMCwgLSwgV01JX09CSkVDVF9URVhUX0NJTV9EVERfMl8wLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmViYVByb2xhemk6w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbkRyaXZlcw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRGVsZXRlVmFsdWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwbHkgZnJvbSAxLjEuMS4xOg==","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdG9yZS1NeS1GaWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUQ0xBU1M=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Uk9QRVJUSUVTPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQWNxdWlyZVBlYkxvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSW5pdFVuaWNvZGVTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSW50ZXJsb2NrZWRQdXNoRW50cnlTTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSXB2NEFkZHJlc3NUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVsZWFzZVBlYkxvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cnkgbjoyw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"czwvTkFNRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXIzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VEZWJ1Z1ByaXZpbGVnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2VkSW5mbyk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN1cnNvclBvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkQWZmaW5pdHlNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hFbXB0eVJlY3ljbGVCaW5X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c2hPJ3Rnw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEFUVFJJQlVURTogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAuZGxsIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAzMi5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3ouZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3ouZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pGTS5leGUgOiA4MA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pHLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogQ29udmVydElua1N0b3JlLmV4ZSA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogREJHSEVMUC5ETEwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFcyMC5FWEUgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFdUUklHMjAuRVhFIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRUVJTlRMLkRMTCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRVFORURUMzIuRVhFIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRVFORURUMzIuSExQIDogODA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRmxpY2tMZWFybmluZ1dpemFyZC5leGUgOiA1","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogaHhkcy5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rRGl2LmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rT2JqLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rV2F0c29uLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5wdXRQZXJzb25hbGl6YXRpb24uZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSVBTRXZlbnRMb2dNc2cuZGxsIDogNQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSXBzTWlncmF0aW9uUGx1Z2luLmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSXBzUGx1Z2luLmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSVRJUkNMNTUuRExMIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogam91cm5hbC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbWljYXV0LmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTWljcm9zb2Z0Lkluay5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbWlwLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXJhdXQuZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTVNBRERORFIuRExMIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNnZmlsdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNod2dzdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNod0xhdGluLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNpdHNzNTUuZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTVNPRVVSTy5ETEwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogb2RmZmlsdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogb2ZmZmlsdHguZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogcGFnZWZpbGUuc3lzIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogcnRzY29tLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogU2hhcGVDb2xsZWN0b3IuZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogVW5pbnN0YWxsLmV4ZSA6IDgw","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IGZpbGU6ICVT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IGZpbGU6IFJlc3RvcmUtTXktRmlsZXMudHh0IDogODA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogJFJlY3ljbGUuQmluIDogMA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogTVNPQ2FjaGUgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogUGVyZkxvZ3MgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IFNZU1RFTTogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c29mdCBDb3Jwb3JhdGlvbi4gQWxsIHJpZ2h0cyByZXNlcnZlZC4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTG9ja0JpdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3FsYWdlbnQ=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3FsYnJvd3Nlcg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3Fsd3JpdGVy","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIl9fUEFUSCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlBhcmFJZCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlZlcmJzIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NvY0NsYXNzICA9","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3Nvcjo6Z2V0X291dHB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3N3b3JkIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3RhbmNlKC0sIFdCRU1fRkxBR19DUkVBVEVfT05MWSwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dCBhdmFpbGFibGU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dDo6Z2V0X2l0ZW0oJWQsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dF9hc3luYyhWQVJJQU5UX0ZBTFNFKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGFQYXNvajp0R0Ne","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VEUsMSwgLSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGU6OnB1dF9ub2RlVmFsdWUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk0Nm1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1MG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1M21z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1NW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1OG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2Mm1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2NW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2N21z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2OG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2OW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk3MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VElOVEVHUklUWQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VElPTj4lczwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dHJhbmZvcm0oLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlYXRBc1N5c3RlbQ==","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlbWUpw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dFZhbHVlKEwiRXhjbHVkZVN5c3RlbVByb3BlcnRpZXMiLDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dHlWYWx1ZS5PYmplY3RMb2NhdG9yPSIiLFByb3BlcnR5TmFtZT0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dWx0Q2xhc3MgPQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VVJMRG93bmxvYWRUb0ZpbGVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXJsbW9uLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHN1YnNjcmlwdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmVyaWZ5VmVyc2lvbkluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmVyU2V0Q29uZGl0aW9uTWFzaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLWNvbnZlcnRlcg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLXVzYmFyYml0YVFCQ0ZNb25pdG9yU2VydmlJbnR1aXQuUXVpY2tCb29rdm13YXJlLWNvbnZlcnRlcmh0dHBzOi8vaXBsby5ydS8xTEpqcTcudHh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":0,"total":71},{"value":"dm13YXJlLXVzYmFyYml0YXRvcjY0","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4uZXhlIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWRlbGV0ZU9sZGVzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V0hFUkUgU2NoZW1hT25seQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2l0aCAzMiBieXRlcyBvZiBkYXRhOg==","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d21pYyAgc2hhZG93Y29weSBkZWxldGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"WMIC.exe","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d21pYy5leGUgU0hBRE9XQ09QWSAvbm9pbnRlcmFjdGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V05ldEdldENvbm5lY3Rpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3ZzcHJpbnRmQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCVvSiUuclwu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WE8xWEFEcE8wMQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WFNMLU1hcHBpbmdzLnhtbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eHRWYWx1ZUxpc3QueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"eHhvSiUlclwuLiQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eXBlKC0sIC0sIDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"emh1ZG9uZ2Zhbmd5dQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA1NEZBRTYxLTRERDgtNDc4Ny04MEI2LTA5MDIyMEM0QjcwMH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIxMTJBQjBBLUM4NkEtNEZGRS1BMzY4LTBERTk2RTQ3MDEyRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ5MUU5MjJGLTU2NDMtNEFGNC1BN0VCLTRFN0ExMzhEODE3NH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezUyQTRGMDIxLTdCNzUtNDhBOS05RjZCLTRCODdBMjEwQkM4Rn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU2Nzg0ODU0LUM2Q0ItNDYyQi04MTY5LTg4RTM1MEFDQjg4Mn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezVDRDdBRUUyLTIyMTktNEE2Ny1CODVELTZDOUNFMTU2NjBDQn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdCMzk2RTU0LTlFQzUtNDMwMC1CRTBBLTI0ODJFQkFFMUEyNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEMUQzQTA0LURFQkItNDExNS05NUNGLTJGMjlEQTI5MjBEQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E3NUQzNjJFLTUwRkMtNEZCNy1BQzJDLUE4QkVBQTMxNDQ5M30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0IyNTBDNjY4LUY1N0QtNEVFMS1BNjNDLTI5MEVFN0QxQUExRn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JDQkQzMDU3LUNBNUMtNDYyMi1CNDJELUJDNTZEQjBBRTUxNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M0OTAwNTQwLTIzNzktNEM3NS04NDRCLTY0RTZGQUY4NzE2Qn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M4NzAwNDRCLUY0OUUtNDEyNi1BOUMzLUI1MkExRkY0MTFFOH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RFQkYyNTM2LUUxQTgtNEM1OS1CNkEyLTQxNDU4NjQ3NkFFQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0U1NTVBQjYwLTE1M0ItNEQxNy05RjA0LUE1RkU5OUZDMTVFQ30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkICVkIG9uIHBhdGggPSAiJVMi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkIDUgb24gcGF0aCA9ICJDOlxcRG9jdW1lbnRzIGFuZCBTZXR0aW5nc1wqIiA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhIUZpbmRDbG9zZSBmYWlsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhRmluZE5leHRGaWxlIGRpZWQgJWxkOyBwYXRoID0gIiVTIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IldRTCIsTCJTRUxFQ1QgKiBGUk9NIE1TRlRfQ2xpVHJhbnNsYXRlVGFibGUiLFdCRU1fRkxBR19GT1JXQVJEX09OTFl8V0JFTV9GTEFHX1JFVFVSTl9JTU1FRElBVEVMWSxOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXNccmVzdWx0bG9nNi5yZWc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L0MgcGluZyAxLjEuMS4xIC1uIDIwID4gTnVsICYgRGVsIC9mIC9xICJDOlxSaWNrczc1LmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdnNzYWRtaW4gZGVsZXRlIHNoYWRvd3MgL2FsbCAvcXVpZXQgJiB3bWljIHNoYWRvd2NvcHkgZGVsZXRlICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVzICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgbm8gJiB3YmFkbWluIGRlbGV0ZSBjYXRhbG9nIC1xdWlldA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ojpsb2FkKEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OkV4ZWNNZXRob2QoTCIlcyIsIEwiJXMiLCAwLCBOVUxMLCAtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9sZW5ndGgoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$32","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBFTkQ+JXM8L0FQUEVORD48VVNFUj4lczwvVVNFUj48QUdHUkVHQVRFPiVzPC9BR0dSRUdBVEU+PC9DT05URVhUPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAQUVCVjBAQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCREBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlBP0FWQ0hTdHJpbmdAQEFFQlYwQFBFQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFFQkFIUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUVCQUhQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUVBQVBFQUdIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElFQkFQRUFVQ0hTdHJpbmdEYXRhQEBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFFQkE/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUVCQT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRRUJBP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WyUuMnU6JS4ydTolLjJ1XSAuICVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwNEVDLS0xNjA2MTczMTM2LTMxNTEyMzY2MTY2MDQzNjQzMTQ0NTc1NTMwMDEzNDY5NDc2MDYxODQ0MTEyNDk1Njk3NTA3NTQwMTI0MzM1MDQ2NQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwRDhDLS0xMTY3ODgyOTEtMTE4Njg2MTQzMi02NzY5MDM3MjUtODMwMDQ5NzAtMTc1MDA4MTE2NS0xMDI2ODI4MDA2LTE1MDQzNjcyMDAtNzU5MDczMjY5","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwREQwLTE3OTU3MTA3NjAtNjU0OTc5MTgwLTgxMjg1NDM1MS0xNzU1ODEyMTE4NjExMzYyMjk3LTE0NjIyNjQzODAyMjA5MzkwNTgxMDg0MTYwNzMy","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAxMjVDLS0xODM5Mjk1MzUxLTIwMjgxOTc4NDEtNDE4ODIzOTM4LTU2MTA5MzI0LTg1NTE5ODk4OC0xMDk3MTczMTEzMTQ3MDU1MTY1OC0xMzk4OTA0NDgz","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDMtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDQtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDctZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVj","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVjcnlwdCB5b3VyIGZpbGVzNC4gUGF5NS4gV2Ugc2VuZCBmb3IgeW91IGRlY3J5cHRvciBzb2Z0d2FyZVdlIGFjY2VwdCBCaXRjb2luQXR0ZW50aW9uIURvIG5vdCByZW5hbWUgZW5jcnlwdGVkIGZpbGVzLkRvIG5vdCB0cnkgdG8gZGVjcnlwdCB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuRGVjcnlwdGlvbiBvZiB5b3VyIGZpbGVzIHdpdGggdGhlIGhlbHAgb2YgdGhpcmQgcGFydGllcyBtYXkgY2F1c2UgaW5jcmVhc2VkICBwcmljZSh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKUNvbnRhY3QgaW5mb3JtYXRpb246IGFiY2QtaGVscEBjb3VudGVybWFpbC5jb21CZSBzdXJlIHRvIGR1cGxpY2F0ZSB5b3VyIG1lc3NhZ2Ugb24gdGhlIGUtbWFpbDogc3VwcG9ydHBjQGNvY2subGlZb3VyIHBlcnNvbmFsIGlkOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXRlOjpwdXRyZWZfc3R5bGVzaGVldCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXduSW5zdGFuY2UoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIlRleHQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkRlbGV0ZUNsYXNzKEwiJXMiLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkdldE9iamVjdChMIiVzIiwgV0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmluZGVsc2VzcG4=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VTZXJ2aWNlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZExpbmVUb0FyZ3ZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFByb2dyYW1z","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0IE1lbnU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uUGljdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVmlkZW8=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb24gRXJyb3IgKHRoZSBlcnJvcmxldmVsIGlzIHV0aWxpdHkgc3BlY2lmaWMp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbFNlcnZpY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIl9fUkVMUEFUSCIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkF1dGhvcml0eSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkZvcm1hdCIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIlByb3BlcnRpZXMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldE5hbWVzKE5VTEwsIFdCRU1fRkxBR19BTFdBWVMgfCBXQkVNX0ZMQUdfTk9OU1lTVEVNX09OTFksIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RE9NRG9jdW1lbnQyOjpjcmVhdGVEb2N1bWVudEZyYWdtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Z2V0X3BhcmVudE5vZGUoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Y2xvbmVOb2RlKFZBUklBTlRfVFJVRSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWROb2RlTWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURlcGVuZGVudFNlcnZpY2VzQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVNDUklQVElPTj4iVW5rbm93biBXQkVNIEVycm9yIjwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwXGRpcjAwMDAuY2hrIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcCA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcFxMYW5nIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcREVTSUdORVIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxDbGlja1RvUnVuIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxEVyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTlwxMDMzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFVVJPIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxGaWx0ZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxHUlBIRkxUIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxIZWxwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYXItU0EgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYmctQkcgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcY3MtQ1ogOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGEtREsgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGUtREUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZWwtR1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZW4tVVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXMtRVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXQtRUUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZmktRkkgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnItRlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9ucyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xudW1iZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51IDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1x3ZWIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaGUtSUwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHItSFIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHUtSFUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcSFdSQ3VzdG9taXphdGlvbiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaXQtSVQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcamEtSlAgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtca28tS1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHQtTFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHYtTFYgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmItTk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmwtTkwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccGwtUEwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtQlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtUFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccm8tUk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccnUtUlUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2stU0sgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2wtU0kgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRhcHRlcnNBZGRyZXNzZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9pcGxvLnJ1LzFMSmpxNy50eHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWNcZXhlY2VuZ2luZS5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aWVmcmFtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXBsby5ydQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":66},{"value":"aXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":71},{"value":"aXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJDb25uZWN0aW9uIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJEZWZhdWx0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJQcm9wZXJ0aWVzIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJWZXJiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpQdXQoTCIlcyIsIDAsIC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OmNyZWF0ZUNEQVRBU2VjdGlvbigtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OnNhdmUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpwdXRfdGV4dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUxvY2F0b3I6OkNvbm5lY3RTZXJ2ZXIoTCIlcyIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDguMC4wOyBTTS1HOTYwRiBCdWlsZC9SMTZOVykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzYyLjAuMzIwMi44NCBNb2JpbGUgU2FmYXJpLzUzNy4zNg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bVNlcnZpY2VzOjpQdXRJbnN0YW5jZSgtLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmVyIFZlcmJpbjZEw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV0V2tzdGFHZXRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXQoTCJTZXJ2ZXIiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXRQcm9wZXJ0eVF1YWxpZmllclNldChMIiVzIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":71},{"value":"T3Blbk11dGV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNlcnZpY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T1I+PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj48L0VSUk9SPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cGluZyAgMS4xLjEuMSAtbiAyMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"PING.EXE","compromised":null,"detection_total":null,"total":null},{"value":"UGluZyBzdGF0aXN0aWNzIGZvciAxLjEuMS4xOiAgICBQYWNrZXRzOiBTZW50ID0gMjAsIFJlY2VpdmVkID0gMjAsIExvc3QgPSAwICgwJSBsb3NzKSw=","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluZ2luZyAxLjEuMS4x","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJDRk1vbml0b3JTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJJRFBTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlTZXJ2aWNlU3RhdHVzRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmM6OkdldFRleHQoMCwgLSwgV01JX09CSkVDVF9URVhUX0NJTV9EVERfMl8wLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbkRyaXZlcw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRGVsZXRlVmFsdWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwbHkgZnJvbSAxLjEuMS4xOg==","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSXB2NEFkZHJlc3NUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VkSW5mbyk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hFbXB0eVJlY3ljbGVCaW5X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAuZGxsIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAzMi5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3ouZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pGTS5leGUgOiA4MA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pHLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogQ29udmVydElua1N0b3JlLmV4ZSA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFcyMC5FWEUgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFdUUklHMjAuRVhFIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRVFORURUMzIuRVhFIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRmxpY2tMZWFybmluZ1dpemFyZC5leGUgOiA1","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rV2F0c29uLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5wdXRQZXJzb25hbGl6YXRpb24uZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSVRJUkNMNTUuRExMIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTWljcm9zb2Z0Lkluay5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbWlwLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNpdHNzNTUuZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogcnRzY29tLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogU2hhcGVDb2xsZWN0b3IuZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogVW5pbnN0YWxsLmV4ZSA6IDgw","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IGZpbGU6IFJlc3RvcmUtTXktRmlsZXMudHh0IDogODA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogJFJlY3ljbGUuQmluIDogMA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIl9fUEFUSCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlBhcmFJZCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlZlcmJzIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3Nvcjo6Z2V0X291dHB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dDo6Z2V0X2l0ZW0oJWQsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGU6OnB1dF9ub2RlVmFsdWUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VElPTj4lczwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHN1YnNjcmlwdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmVyaWZ5VmVyc2lvbkluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLWNvbnZlcnRlcg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLXVzYmFyYml0YVFCQ0ZNb25pdG9yU2VydmlJbnR1aXQuUXVpY2tCb29rdm13YXJlLWNvbnZlcnRlcmh0dHBzOi8vaXBsby5ydS8xTEpqcTcudHh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":0,"total":71},{"value":"dm13YXJlLXVzYmFyYml0YXRvcjY0","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4uZXhlIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWRlbGV0ZU9sZGVzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d21pYy5leGUgU0hBRE9XQ09QWSAvbm9pbnRlcmFjdGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V05ldEdldENvbm5lY3Rpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eXBlKC0sIC0sIDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ezA1NEZBRTYxLTRERDgtNDc4Ny04MEI2LTA5MDIyMEM0QjcwMH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIxMTJBQjBBLUM4NkEtNEZGRS1BMzY4LTBERTk2RTQ3MDEyRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ5MUU5MjJGLTU2NDMtNEFGNC1BN0VCLTRFN0ExMzhEODE3NH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezUyQTRGMDIxLTdCNzUtNDhBOS05RjZCLTRCODdBMjEwQkM4Rn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU2Nzg0ODU0LUM2Q0ItNDYyQi04MTY5LTg4RTM1MEFDQjg4Mn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezVDRDdBRUUyLTIyMTktNEE2Ny1CODVELTZDOUNFMTU2NjBDQn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdCMzk2RTU0LTlFQzUtNDMwMC1CRTBBLTI0ODJFQkFFMUEyNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEMUQzQTA0LURFQkItNDExNS05NUNGLTJGMjlEQTI5MjBEQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E3NUQzNjJFLTUwRkMtNEZCNy1BQzJDLUE4QkVBQTMxNDQ5M30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0IyNTBDNjY4LUY1N0QtNEVFMS1BNjNDLTI5MEVFN0QxQUExRn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JDQkQzMDU3LUNBNUMtNDYyMi1CNDJELUJDNTZEQjBBRTUxNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M0OTAwNTQwLTIzNzktNEM3NS04NDRCLTY0RTZGQUY4NzE2Qn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M4NzAwNDRCLUY0OUUtNDEyNi1BOUMzLUI1MkExRkY0MTFFOH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RFQkYyNTM2LUUxQTgtNEM1OS1CNkEyLTQxNDU4NjQ3NkFFQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0U1NTVBQjYwLTE1M0ItNEQxNy05RjA0LUE1RkU5OUZDMTVFQ30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"Ricks75.exe.bin","strings":[{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkICVkIG9uIHBhdGggPSAiJVMi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhIUZpbmRDbG9zZSBmYWlsZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhISEhISEhISEhISEhRmluZE5leHRGaWxlIGRpZWQgJWxkOyBwYXRoID0gIiVTIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXNcYm9vdG1ncg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXNccmVzdWx0bG9nNi5yZWc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JmpMJjZabDY/QX4/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LzFMSmpxNy50eHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O2QyMlZ0OjpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSYmakw2NlpsPz9Bfg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WyUuMnU6JS4ydTolLjJ1XSAuICVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxDZFJvbQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxGbG9wcHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWRmaWxlLnR4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVjcnlwdCB5b3VyIGZpbGVzNC4gUGF5NS4gV2Ugc2VuZCBmb3IgeW91IGRlY3J5cHRvciBzb2Z0d2FyZVdlIGFjY2VwdCBCaXRjb2luQXR0ZW50aW9uIURvIG5vdCByZW5hbWUgZW5jcnlwdGVkIGZpbGVzLkRvIG5vdCB0cnkgdG8gZGVjcnlwdCB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuRGVjcnlwdGlvbiBvZiB5b3VyIGZpbGVzIHdpdGggdGhlIGhlbHAgb2YgdGhpcmQgcGFydGllcyBtYXkgY2F1c2UgaW5jcmVhc2VkICBwcmljZSh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKUNvbnRhY3QgaW5mb3JtYXRpb246IGFiY2QtaGVscEBjb3VudGVybWFpbC5jb21CZSBzdXJlIHRvIGR1cGxpY2F0ZSB5b3VyIG1lc3NhZ2Ugb24gdGhlIGUtbWFpbDogc3VwcG9ydHBjQGNvY2subGlZb3VyIHBlcnNvbmFsIGlkOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdC5leGUgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzpcYmFkcGF0aA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclRvT2VtQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VTZXJ2aWNlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRPYmplY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWFuZExpbmVUb0FyZ3ZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29udHJvbFNlcnZpY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2VsbEtub3duU2lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q1JZUFQzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRHZW5SYW5kb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RCIiZlQqKn47","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YSBCdWZmZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURlcGVuZGVudFNlcnZpY2VzQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWRhcHRlcnNBZGRyZXNzZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHJpdmVUeXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9naWNhbERyaXZlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VmVyc2lvbkV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9pcGxvLnJ1LzFMSmpxNy50eHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENyZWF0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcFNlbmRFY2hv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQb3BFbnRyeVNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SVBITFBBUEkuRExM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SiUlb1wuLnI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"akwmJlpsNjZBfj8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TCYmamw2Nlp+Pz9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGRyRW51bWVyYXRlTG9hZGVkTW9kdWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9va3VwUHJpdmlsZWdlVmFsdWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcGlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bHN0cmNtcGlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IEJhc2UgQ3J5cHRvZ3JhcGhpYyBQcm92aWRlciB2MS4w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bU1pY3Jvc29mdCBCYXNlIENyeXB0b2dyYXBoaWMgUHJvdmlkZXIgdjEuMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TW96aWxsYS81LjAgKExpbnV4OyBBbmRyb2lkIDguMC4wOyBTTS1HOTYwRiBCdWlsZC9SMTZOVykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzYyLjAuMzIwMi44NCBNb2JpbGUgU2FmYXJpLzUzNy4zNg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TkVUQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0QXBpQnVmZmVyRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0U2hhcmVFbnVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV0V2tzdGFHZXRJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TnRBbGxvY2F0ZVZpcnR1YWxNZW1vcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3Blbk11dGV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNDTWFuYWdlckE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblNlcnZpY2VB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aEFkZEJhY2tzbGFzaFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aEZpbmRFeHRlbnNpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUJhY2tzbGFzaFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUV4dGVuc2lvbkE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGF0aFJlbW92ZUZpbGVTcGVjVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlTZXJ2aWNlU3RhdHVzRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnRGVsZXRlVmFsdWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdG9yZS1NeS1GaWxlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQWNxdWlyZVBlYkxvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSW5pdFVuaWNvZGVTdHJpbmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSW50ZXJsb2NrZWRQdXNoRW50cnlTTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsSXB2NEFkZHJlc3NUb1N0cmluZ0E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsUmVsZWFzZVBlYkxvY2s=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VEZWJ1Z1ByaXZpbGVnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkQWZmaW5pdHlNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hFTEwzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hFbXB0eVJlY3ljbGVCaW5X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hHZXRGb2xkZXJQYXRoVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEFUVFJJQlVURTogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IGZpbGU6ICVT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IFNZU1RFTTogJVM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTG9ja0JpdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VVJMRG93bmxvYWRUb0ZpbGVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXJsbW9uLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmVyaWZ5VmVyc2lvbkluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmVyU2V0Q29uZGl0aW9uTWFzaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLXVzYmFyYml0YVFCQ0ZNb25pdG9yU2VydmlJbnR1aXQuUXVpY2tCb29rdm13YXJlLWNvbnZlcnRlcmh0dHBzOi8vaXBsby5ydS8xTEpqcTcudHh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":0,"total":71},{"value":"dnNzYWRtaW4uZXhlIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWRlbGV0ZU9sZGVzdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d21pYy5leGUgU0hBRE9XQ09QWSAvbm9pbnRlcmFjdGl2ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V05ldEdldENvbm5lY3Rpb25X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3NwcmludGZX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3ZzcHJpbnRmQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCVvSiUuclwu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eHhvSiUlclwuLiQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"Ricks75.exe.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"Ricks75.exe:1596","strings":[{"value":"ISEhISEhISEhISEhISEhISEhISEhIUZpbmRGaXJzdEZJbGUgZmFpbGVkIDUgb24gcGF0aCA9ICJDOlxcRG9jdW1lbnRzIGFuZCBTZXR0aW5nc1wqIiA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ny1wUljDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"PjwvYXNzZV/Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YCQgNVvDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDMtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDQtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDctZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQhVGhlcmUgaXMgIG9ubHkgb25lIHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrOjEuIENvbnRhY3Qgd2l0aCB1czIuIFNlbmQgdXMgMSBhbnkgZW5jcnlwdGVkIHlvdXIgZmlsZSBhbmQgeW91ciBwZXJzb25hbCBrZXkzLiBXZSB3aWxsIGRlY3J5cHQgMSBmaWxlIGZvciB0ZXN0KG1heGltdW0gZmlsZSBzaXplIC0gMSBNQiksIGl0cyBndWFyYW50ZWUgd2hhdCB3ZSBjYW4gZGVj","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmFuZyBEw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmluZGVsc2VzcG4=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJ1a0dvbmdlciUmbg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0QgQnVybmluZw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFByb2dyYW1z","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0IE1lbnU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uUGljdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uVmlkZW8=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ycmV1dG9zOmnDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3RvcjzDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3Vsc2VydmVy","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2F0Y2g=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG8gRGlyZXQ=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZSBkaSBtw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5kP3rDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcZm91bmQuMDAwXGRpcjAwMDAuY2hrIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcCA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1w3LVppcFxMYW5nIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcREVTSUdORVIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxDbGlja1RvUnVuIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxEVyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFUVVBVElPTlwxMDMzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxFVVJPIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxGaWx0ZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxHUlBIRkxUIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxIZWxwIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYXItU0EgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcYmctQkcgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcY3MtQ1ogOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGEtREsgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZGUtREUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZWwtR1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZW4tVVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXMtRVMgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZXQtRUUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZmktRkkgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnItRlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9ucyA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xhdXhwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xrZXlwYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xtYWluIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xudW1iZXJzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2ttZW51IDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2tudW1wYWQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xvc2twcmVkIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1xzeW1ib2xzIDogMTg=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcZnNkZWZpbml0aW9uc1x3ZWIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaGUtSUwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHItSFIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaHUtSFUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcSFdSQ3VzdG9taXphdGlvbiA6IDE4","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcaXQtSVQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcamEtSlAgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtca28tS1IgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHQtTFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbHYtTFYgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmItTk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcbmwtTkwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccGwtUEwgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtQlIgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccHQtUFQgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccm8tUk8gOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtccnUtUlUgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2stU0sgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVhJVCBDOlxcUHJvZ3JhbSBGaWxlc1xDb21tb24gRmlsZXNcTWljcm9zb2Z0IFNoYXJlZFxpbmtcc2wtU0kgOiAxOA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmF2b3JpdGVz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWVmcmFtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50dWl0LlF1aWNrQm9va3MuRkNT","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXRvNifDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXp6b2hlw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2FzIChKdW5jPcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VhciBmb2FyYmVpOmp8w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuU2VydmVy","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFzdEVudW0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHRhUGFzaTp3LHXDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwc3BsaXRzaW5nw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q2FwYWNpdHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXkgUGljdHVyZXM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXkgVmlkZW8=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmQgb2YgZG9jX0bDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmQgb2bDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmVyIFZlcmJpbjZEw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmllIGthdGFsw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVrZU9uRGVsZXRl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2NodF7Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFzc2Fkw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbURhdGE=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZ3JhbUZpbGVzRGly","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJDRk1vbml0b3JTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UUJJRFBTZXJ2aWNl","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ci5PJ3RrZW4t","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFiYXdfU8Ovwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmViYVByb2xhemk6w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVjeWNsZUJpbkRyaXZlcw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cnkgbjoyw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hPJ3Rnw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAuZGxsIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogNy16aXAzMi5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3ouZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3ouZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pGTS5leGUgOiA4MA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogN3pHLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogQ29udmVydElua1N0b3JlLmV4ZSA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogREJHSEVMUC5ETEwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFcyMC5FWEUgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRFdUUklHMjAuRVhFIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRUVJTlRMLkRMTCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRVFORURUMzIuRVhFIDogOTk3","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRVFORURUMzIuSExQIDogODA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogRmxpY2tMZWFybmluZ1dpemFyZC5leGUgOiA1","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogaHhkcy5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rRGl2LmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rT2JqLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5rV2F0c29uLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSW5wdXRQZXJzb25hbGl6YXRpb24uZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSVBTRXZlbnRMb2dNc2cuZGxsIDogNQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSXBzTWlncmF0aW9uUGx1Z2luLmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSXBzUGx1Z2luLmRsbCA6IDU=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogSVRJUkNMNTUuRExMIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogam91cm5hbC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbWljYXV0LmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTWljcm9zb2Z0Lkluay5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbWlwLmV4ZSA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXJhdXQuZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTVNBRERORFIuRExMIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNnZmlsdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNod2dzdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNod0xhdGluLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogbXNpdHNzNTUuZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogTVNPRVVSTy5ETEwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogb2RmZmlsdC5kbGwgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogb2ZmZmlsdHguZGxsIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogcGFnZWZpbGUuc3lzIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogcnRzY29tLmRsbCA6IDE4Mw==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogU2hhcGVDb2xsZWN0b3IuZXhlIDogMTgz","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEVYVEVOU0lPTjogVW5pbnN0YWxsLmV4ZSA6IDgw","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IGZpbGU6IFJlc3RvcmUtTXktRmlsZXMudHh0IDogODA=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogJFJlY3ljbGUuQmluIDogMA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogTVNPQ2FjaGUgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2tpcGVkIGJ5IEZPTERFUjogUGVyZkxvZ3MgOiAxODM=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3FsYWdlbnQ=","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3FsYnJvd3Nlcg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3Fsd3JpdGVy","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGFQYXNvajp0R0Ne","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlbWUpw6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLWNvbnZlcnRlcg==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm13YXJlLXVzYmFyYml0YXRvcjY0","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WE8xWEFEcE8wMQ==","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"emh1ZG9uZ2Zhbmd5dQ==","type":"Ansi","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA1NEZBRTYxLTRERDgtNDc4Ny04MEI2LTA5MDIyMEM0QjcwMH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIxMTJBQjBBLUM4NkEtNEZGRS1BMzY4LTBERTk2RTQ3MDEyRX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ5MUU5MjJGLTU2NDMtNEFGNC1BN0VCLTRFN0ExMzhEODE3NH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezUyQTRGMDIxLTdCNzUtNDhBOS05RjZCLTRCODdBMjEwQkM4Rn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU2Nzg0ODU0LUM2Q0ItNDYyQi04MTY5LTg4RTM1MEFDQjg4Mn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezVDRDdBRUUyLTIyMTktNEE2Ny1CODVELTZDOUNFMTU2NjBDQn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdCMzk2RTU0LTlFQzUtNDMwMC1CRTBBLTI0ODJFQkFFMUEyNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezdEMUQzQTA0LURFQkItNDExNS05NUNGLTJGMjlEQTI5MjBEQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0E3NUQzNjJFLTUwRkMtNEZCNy1BQzJDLUE4QkVBQTMxNDQ5M30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0IyNTBDNjY4LUY1N0QtNEVFMS1BNjNDLTI5MEVFN0QxQUExRn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JDQkQzMDU3LUNBNUMtNDYyMi1CNDJELUJDNTZEQjBBRTUxNn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M0OTAwNTQwLTIzNzktNEM3NS04NDRCLTY0RTZGQUY4NzE2Qn0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0M4NzAwNDRCLUY0OUUtNDEyNi1BOUMzLUI1MkExRkY0MTFFOH0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RFQkYyNTM2LUUxQTgtNEM1OS1CNkEyLTQxNDU4NjQ3NkFFQX0=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0U1NTVBQjYwLTE1M0ItNEQxNy05RjA0LUE1RkU5OUZDMTVFQ30=","type":"Unicode","source":"Runtime Data","process":"Ricks75.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"WMIC.exe:3052","strings":[{"value":"IixubnV1bnkgUSBMIFE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkNJTVRZUEUiLCAwLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IldRTCIsTCJTRUxFQ1QgKiBGUk9NIE1TRlRfQ2xpVHJhbnNsYXRlVGFibGUiLFdCRU1fRkxBR19GT1JXQVJEX09OTFl8V0JFTV9GTEFHX1JFVFVSTl9JTU1FRElBVEVMWSxOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KiBGUk9NIE1TRlRfQ2xpVHJhbnNsYXRlVGFibGU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNIZWFwX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNYX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNhZmVJbnRFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB92000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDAuMTYzODU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ojpsb2FkKEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OkV4ZWNNZXRob2QoTCIlcyIsIEwiJXMiLCAwLCBOVUxMLCAtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9sZW5ndGgoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$33","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFycmF5IG9m","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFTU09DLk9CSkVDVEFSUkFZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBFTkQ+JXM8L0FQUEVORD48VVNFUj4lczwvVVNFUj48QUdHUkVHQVRFPiVzPC9BR0dSRUdBVEU+PC9DT05URVhUPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVtYmVkZWQgT2JqZWN0Pg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEhSRVNVTFQ+MHgleDwvSFJFU1VMVD4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PiVzPC9WQUxVRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAQUVCVjBAQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCREBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFFQUFAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlFFQkRIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQEFFQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xQ0hTdHJpbmdAQFFFQUFAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xZXhjZXB0aW9uQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlBP0FWQ0hTdHJpbmdAQEFFQlYwQFBFQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBBRUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFFQUFBRUJWMEBQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0VtcHR5QENIU3RyaW5nQEBRRUFBWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFFQkFIUEVCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUVCQUhQRUJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0Zvcm1hdEBDSFN0cmluZ0BAUUVBQVhQRUJHWlo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUVBQVBFQUdIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElFQkFQRUFVQ0hTdHJpbmdEYXRhQEBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFFQkE/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUVCQT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRRUJBP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3Rlcm1pbmF0ZUBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1MZWZ0QENIU3RyaW5nQEBRRUFBWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1SaWdodEBDSFN0cmluZ0BAUUVBQVhYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3doYXRAZXhjZXB0aW9uQEBVRUJBUEVCRFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"W1VOS05PV05d","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxXYmVtXENJTU9N","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Xz0yIkYyLkYmbnU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DX3NwZWNpZmljX2hhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DbGFzcyA9ICAi","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19ERVJJVkFUSU9O","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxvbmV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NhbGxuZXdo","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2ZpbGVsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbnByaW50Zg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbndwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3dmcmVvcGVu","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWdOYW1lKEwiVkFMVUUiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxpZmllcnMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NDTEFTUw==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRlOjpwdXRyZWZfc3R5bGVzaGVldCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXRzIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlKEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXduSW5zdGFuY2UoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIlRleHQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkRlbGV0ZUNsYXNzKEwiJXMiLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtU2VydmljZXM6OkdldE9iamVjdChMIiVzIiwgV0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0xJUEJPQVJE","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tbWVyY2lhbERhdGFPcHRJbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGlsYXRpb24gRXJyb3IgKHRoZSBlcnJvcmxldmVsIGlzIHV0aWxpdHkgc3BlY2lmaWMp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dExpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIl9fUkVMUEFUSCIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkF1dGhvcml0eSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIkZvcm1hdCIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldChMIlByb3BlcnRpZXMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OkdldE5hbWVzKE5VTEwsIFdCRU1fRkxBR19BTFdBWVMgfCBXQkVNX0ZMQUdfTk9OU1lTVEVNX09OTFksIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVyaXZhdGlvbiIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NRG9jdW1lbnQyOjpjcmVhdGVEb2N1bWVudEZyYWdtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Z2V0X3BhcmVudE5vZGUoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Y2xvbmVOb2RlKFZBUklBTlRfVFJVRSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZWROb2RlTWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlT2JqZWN0VmFsaWRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHJpdmF0ZU9iamVjdEhlYXA=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJJVkFUSU9OPiVzPC9ERVJJVkFUSU9OPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVNDUklQVElPTj4iVW5rbm93biBXQkVNIEVycm9yIjwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXROYW1lZEl0ZW0oLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RkFJTDogJXM=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RkYiKm5ubm55biBOIEwgTg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RklOSVRFLCAxLC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGVyZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGZvcm0ueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWNcZXhlY2VuZ2luZS5jcHA=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZTZW5kRWNobzI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpZmllckxpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SU1QRVJTT05BVEU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBtYXAvc2V0PFQ+IGl0ZXJhdG9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBwYXJhbWV0ZXIgcGFzc2VkIHRvIEMgcnVudGltZSBmdW5jdGlvbi4=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNUZXh0UGxhaW5Ib25vcmVk","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVRZQ09ERT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TCIlcyIsIEwiJXMiLCAqLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGQoLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TEVDVCAqIEZST00=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TElUWUNPREU+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE1ET01BSU46","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nIEZpbGUgTWF4IFNpemU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TFQsIFJQQ19DX0FVVEhaX05PTkUsIE5VTEwsICVkLCAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4IFNpemU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJDb25uZWN0aW9uIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJEZWZhdWx0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJQcm9wZXJ0aWVzIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpHZXQoTCJWZXJiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUNsYXNzT2JqZWN0OjpQdXQoTCIlcyIsIDAsIC0sIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVtbW92ZV9z","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OmNyZWF0ZUNEQVRBU2VjdGlvbigtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Eb2N1bWVudDI6OnNhdmUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpwdXRfdGV4dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUxvY2F0b3I6OkNvbm5lY3RTZXJ2ZXIoTCIlcyIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bVNlcnZpY2VzOjpQdXRJbnN0YW5jZSgtLCAwLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1I5MC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZShMIlJFQ09SRCIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TkFNRVNQQUNF","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TkNFTlVNPSIlZCIgSVNTVUVERlJPTT0iJXMiIFNUQVJUVElNRT0iJXMiIEVWRVJZQ09VTlQ9IiVkIj4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmU6ICU2ZCBGaWxlOiAlcw==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tk9JTlRFUkFDVElWRQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEZvdW5k","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEltcGxlbWVudGVk","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXQoTCJTZXJ2ZXIiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0OjpHZXRQcm9wZXJ0eVF1YWxpZmllclNldChMIiVzIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0JKRUNUQVJSQVk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0TGltaXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0RFPSIlcyI+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b21tYW5kbGluZSBVdGlsaXR5","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1BFUlRZQ09VTlQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1I+PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj48L0VSUk9SPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3VuZC4gQ29ubmVjdGluZyB0byBtc180MDkiLCBOVUxMLCBOVUxMLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UENfQ19BVVRITl9HU1NfS0VSQkVST1MsUlBDX0NfQVVUSFpfTk9ORSwgJXMsICVkLCAgICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJPQ19TRVJWRVIsIDAsIDEsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmFtZXRlcnMiLDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmM6OkdldFRleHQoMCwgLSwgV01JX09CSkVDVF9URVhUX0NJTV9EVERfMl8wLCAtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUQ0xBU1M=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Uk9QRVJUSUVTPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"czwvTkFNRT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXIzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VkSW5mbyk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN1cnNvclBvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c29mdCBDb3Jwb3JhdGlvbi4gQWxsIHJpZ2h0cyByZXNlcnZlZC4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIl9fUEFUSCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlBhcmFJZCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldChMIlZlcmJzIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NvY0NsYXNzICA9","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3Nvcjo6Z2V0X291dHB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3N3b3JkIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3RhbmNlKC0sIFdCRU1fRkxBR19DUkVBVEVfT05MWSwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dCBhdmFpbGFibGU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dDo6Z2V0X2l0ZW0oJWQsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dF9hc3luYyhWQVJJQU5UX0ZBTFNFKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VEUsMSwgLSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGU6OnB1dF9ub2RlVmFsdWUoTCIlcyIp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VElOVEVHUklUWQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VElPTj4lczwvREVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dHJhbmZvcm0oLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dFZhbHVlKEwiRXhjbHVkZVN5c3RlbVByb3BlcnRpZXMiLDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dHlWYWx1ZS5PYmplY3RMb2NhdG9yPSIiLFByb3BlcnR5TmFtZT0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dWx0Q2xhc3MgPQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHN1YnNjcmlwdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHRvbyBsb25n","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB93000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V0hFUkUgU2NoZW1hT25seQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WFNMLU1hcHBpbmdzLnhtbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eHRWYWx1ZUxpc3QueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"eXBlKC0sIC0sIDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00025853-00003052.00000001.26191.FFB21000.00000020.mdmp","compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe","strings":[{"value":"L0MgcGluZyAxLjEuMS4xIC1uIDIwID4gTnVsICYgRGVsIC9mIC9xICJDOlxSaWNrczc1LmV4ZSI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdnNzYWRtaW4gZGVsZXRlIHNoYWRvd3MgL2FsbCAvcXVpZXQgJiB3bWljIHNoYWRvd2NvcHkgZGVsZXRlICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVzICYgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgbm8gJiB3YmFkbWluIGRlbGV0ZSBjYXRhbG9nIC1xdWlldA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"bcdedit.exe","strings":[{"value":"L3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe:1304","strings":[{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwNEVDLS0xNjA2MTczMTM2LTMxNTEyMzY2MTY2MDQzNjQzMTQ0NTc1NTMwMDEzNDY5NDc2MDYxODQ0MTEyNDk1Njk3NTA3NTQwMTI0MzM1MDQ2NQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe:3488","strings":[{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwRDhDLS0xMTY3ODgyOTEtMTE4Njg2MTQzMi02NzY5MDM3MjUtODMwMDQ5NzAtMTc1MDA4MTE2NS0xMDI2ODI4MDA2LTE1MDQzNjcyMDAtNzU5MDczMjY5","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"bcdedit.exe:1892","strings":[{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwREQwLTE3OTU3MTA3NjAtNjU0OTc5MTgwLTgxMjg1NDM1MS0xNzU1ODEyMTE4NjExMzYyMjk3LTE0NjIyNjQzODAyMjA5MzkwNTgxMDg0MTYwNzMy","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlYXRBc1N5c3RlbQ==","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"PING.EXE:4720","strings":[{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAxMjVDLS0xODM5Mjk1MzUxLTIwMjgxOTc4NDEtNDE4ODIzOTM4LTU2MTA5MzI0LTg1NTE5ODk4OC0xMDk3MTczMTEzMTQ3MDU1MTY1OC0xMzk4OTA0NDgz","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwcm94aW1hdGUgcm91bmQgdHJpcCB0aW1lcyBpbiBtaWxsaS1zZWNvbmRzOiAgICBNaW5pbXVtID0gMW1zLCBNYXhpbXVtID0gLTM5NDZtcywgQXZlcmFnZSA9IDIxNDc0NDgwMG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZXM9MzI=","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdFRUTA==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5zdGFsbExhbmd1YWdlRmFsbGJhY2s=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluZyBzdGF0aXN0aWNzIGZvciAxLjEuMS4xOiAgICBQYWNrZXRzOiBTZW50ID0gMjAsIFJlY2VpdmVkID0gMjAsIExvc3QgPSAwICgwJSBsb3NzKSw=","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluZ2luZyAxLjEuMS4x","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVwbHkgZnJvbSAxLjEuMS4xOg==","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk0Nm1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1MG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1M21z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1NW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk1OG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2Mm1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2NW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2N21z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2OG1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk2OW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGltZT0tMzk3MW1z","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2l0aCAzMiBieXRlcyBvZiBkYXRhOg==","type":"Ansi","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"PING.EXE","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"Xz9fX19fX18wXz9sX19sX19fX19fcV9fPz9fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe","strings":[{"value":"RGVsZXRlIFNoYWRvd3MgL0FsbCAvUXVpZXQ=","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"PCAP","strings":[{"value":"aXBsby5ydQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":66},{"value":"aXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":71},{"value":"b2NzcC5pbnQteDMubGV0c2VuY3J5cHQub3Jn","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":71}]},{"name":"PING.EXE","strings":[{"value":"cGluZyAgMS4xLjEuMSAtbiAyMA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"PING.EXE","compromised":null,"detection_total":null,"total":null}]},{"name":"WMIC.exe","strings":[{"value":"d21pYyAgc2hhZG93Y29weSBkZWxldGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"WMIC.exe","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["1.1.1.1","88.99.66.31","WMIC.pdb","http://iplo.ru","http://isrg.trustid.ocsp.identrust.com","http://ocsp.int-x3.letsencrypt.org","https://iplo.ru/1ljjq7.txt"],"tags_details":[],"sample_flags":["Network Traffic","Extracted Files","User Comment","TOR analysis"],"suricata_alerts":[],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Acrobat Reader DC","version":"18.9.20050.254034"},{"name":"Chrome","product":null,"version":null},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"57.0.1"},{"name":"Flash","product":"Shockwave Flash","version":"27,0,0,187"},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.9600.16428"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1510.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":null,"file_imports":[{"module":"ADVAPI32.dll","functions":["AdjustTokenPrivileges","CheckTokenMembership","CloseServiceHandle","ControlService","CreateWellKnownSid","CryptAcquireContextW","CryptGenRandom","CryptReleaseContext","EnumDependentServicesA","GetTokenInformation","LookupPrivilegeValueA","OpenProcessToken","OpenSCManagerA","OpenServiceA","QueryServiceStatusEx","RegCloseKey","RegCreateKeyExW","RegDeleteValueW","RegQueryValueExW","RegSetValueExW"]},{"module":"CRYPT32.dll","functions":["CryptBinaryToStringA"]},{"module":"IPHLPAPI.DLL","functions":["GetAdaptersAddresses","IcmpCreateFile","IcmpSendEcho"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CreateFileW","CreateIoCompletionPort","CreateMutexA","CreateProcessW","CreateThread","CreateToolhelp32Snapshot","DeleteCriticalSection","EnterCriticalSection","ExitProcess","ExitThread","FindClose","FindFirstFileExW","FindNextFileW","GetCommandLineW","GetComputerNameA","GetDiskFreeSpaceW","GetDriveTypeW","GetFileAttributesW","GetFileSizeEx","GetLastError","GetLocalTime","GetLogicalDrives","GetModuleFileNameW","GetModuleHandleA","GetProcAddress","GetProcessHeap","GetQueuedCompletionStatus","GetStdHandle","GetSystemInfo","GetTickCount","GetVersionExA","GetWindowsDirectoryW","HeapAlloc","HeapFree","InitializeCriticalSection","InitializeSListHead","InterlockedFlushSList","InterlockedPopEntrySList","LeaveCriticalSection","LoadLibraryA","lstrcatW","lstrcmpA","lstrcmpiA","lstrcmpiW","lstrcmpW","lstrcpyA","lstrcpyW","lstrlenA","lstrlenW","MoveFileExW","MoveFileW","OpenMutexA","OpenProcess","Process32First","Process32Next","ReadFile","SetFileAttributesW","SetFilePointer","SetFileTime","SetThreadAffinityMask","Sleep","SystemTimeToFileTime","TerminateProcess","VerifyVersionInfoW","WaitForMultipleObjects","WaitForMultipleObjectsEx","WaitForSingleObject","WriteFile"]},{"module":"MPR.dll","functions":["WNetGetConnectionW"]},{"module":"msvcrt.dll","functions":["calloc","free","malloc"]},{"module":"NETAPI32.dll","functions":["NetApiBufferFree","NetShareEnum","NetWkstaGetInfo"]},{"module":"ntdll.dll","functions":["LdrEnumerateLoadedModules","NtAllocateVirtualMemory","RtlAcquirePebLock","RtlInitUnicodeString","RtlInterlockedPushEntrySList","RtlReleasePebLock","VerSetConditionMask"]},{"module":"ole32.dll","functions":["CoGetObject","CoInitializeEx","CoUninitialize"]},{"module":"SHELL32.dll","functions":["CommandLineToArgvW","ShellExecuteExW","SHEmptyRecycleBinW","SHGetFolderPathW"]},{"module":"SHLWAPI.dll","functions":["PathAddBackslashW","PathFindExtensionW","PathRemoveBackslashW","PathRemoveExtensionA","PathRemoveFileSpecW"]},{"module":"urlmon.dll","functions":["URLDownloadToFileA"]},{"module":"USER32.dll","functions":["CharToOemA","wsprintfA","wsprintfW","wvsprintfA"]},{"module":"WS2_32.dll","functions":["inet_addr","WSACleanup","WSAStartup"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":null,"authentihash":"8d304be5c24f188ccaf114833913fb1f584592a6bec4b8a5a34923fd0242df66","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":6.49453429901,"virtual_address":"0x1000","virtual_size":"0xf2e9","raw_size":"0xf400","md5":"2ce69b85cbbc47bc2e0e0b7d25d27d64","characteristics":[]},{"name":".rdata","entropy":7.20714410425,"virtual_address":"0x11000","virtual_size":"0x3d44","raw_size":"0x3e00","md5":"c7075776475c3b714467edef7bd861ac","characteristics":[]},{"name":".data","entropy":5.41330444828,"virtual_address":"0x15000","virtual_size":"0x2440","raw_size":"0x800","md5":"1c9ba6736abda09e2317d62284ed4a9d","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[{"_id":"5e98bbcbd8def722f55e6567","content":"#ransomware #abcd","user":{"_id":"5d3b2c8a0288383b0a1d1847","name":"f0wL"},"created_at":"2019-12-06T11:16:09+00:00"}],"email_headers":null,"classification_tags":["apt","apt28","fancybear","group-4127","group74","irontwilight","pawnstorm","ransomware","sednit","sofacy","strontium","swallowtail","tag_0700","tg-4127","tsarteam"],"tags":["ransomware","abcd","apt","apt28","fancybear","group-4127","group74","irontwilight","pawnstorm","sednit","sofacy","strontium","swallowtail","tag_0700","tg-4127","tsarteam"],"submissions":[{"submission_id":"5fbede8ad6e4bb1cb00c3fad","filename":"ABCD.exe","url":null,"created_at":"2020-11-25T22:45:30+00:00"},{"submission_id":"5de6924cf36b5957801b0bee","filename":"Ricks75.exe","url":null,"created_at":"2019-12-03T16:50:20+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Network whitenoise filtering was applied","Not all file accesses are visible for PING.EXE (PID: 4720)","Not all file accesses are visible for WMIC.exe (PID: 3052)","Not all file accesses are visible for bcdedit.exe (PID: 1892)","Not all file accesses are visible for bcdedit.exe (PID: 2348)","Not all file accesses are visible for cmd.exe (PID: 1776)","Not all file accesses are visible for cmd.exe (PID: 4680)","Not all file accesses are visible for vssadmin.exe (PID: 1304)","Not all file accesses are visible for vssadmin.exe (PID: 3488)","Not all sources for indicator ID \"api-25\" are available in the report","Not all sources for indicator ID \"api-55\" are available in the report","Not all sources for indicator ID \"api-77\" are available in the report","Not all sources for indicator ID \"hooks-8\" are available in the report","Not all sources for indicator ID \"mutant-0\" are available in the report","Not all sources for indicator ID \"network-32\" are available in the report","Not all sources for indicator ID \"registry-72\" are available in the report","Some low-level data is hidden, as this is only a slim report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/5de68fd5147c6120bb7d5d0c/download/files/report_json","file_size":805687},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/5de68fd5147c6120bb7d5d0c/download/files/memory_strings","file_size":12599},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/5de68fd5147c6120bb7d5d0c/download/files/network_pcap","file_size":49992},"memory_dumps":null},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":99.1168},{"x":1,"y":95.5677},{"x":2,"y":100},{"x":3,"y":100},{"x":4,"y":100},{"x":5,"y":100},{"x":6,"y":100},{"x":7,"y":100},{"x":8,"y":100},{"x":9,"y":100},{"x":10,"y":100}],"memory_usage":[{"x":0,"y":24.1762},{"x":1,"y":31.3963},{"x":2,"y":31.4711},{"x":3,"y":31.715},{"x":4,"y":32.0015},{"x":5,"y":32.6634},{"x":6,"y":34.1118},{"x":7,"y":34.4253},{"x":8,"y":34.2127},{"x":9,"y":35.1123},{"x":10,"y":35.2769}],"disk_read":[{"x":0,"y":3192890},{"x":1,"y":3576900},{"x":2,"y":5058190},{"x":3,"y":1174980},{"x":4,"y":4919120},{"x":5,"y":4466450},{"x":6,"y":3029430},{"x":7,"y":7211570},{"x":8,"y":6520990},{"x":9,"y":93238.8},{"x":10,"y":16807}],"disk_write":[{"x":0,"y":3658250},{"x":1,"y":4710170},{"x":2,"y":4062600},{"x":3,"y":5199260},{"x":4,"y":6311880},{"x":5,"y":7638940},{"x":6,"y":5959110},{"x":7,"y":11505600},{"x":8,"y":4849980},{"x":9,"y":3836680},{"x":10,"y":8522570}],"network_packets":[{"x":0,"y":116.64},{"x":1,"y":38.7372},{"x":2,"y":45.3653},{"x":3,"y":68.7948},{"x":4,"y":60.1352},{"x":5,"y":108.098},{"x":6,"y":69.2125},{"x":7,"y":46.9147},{"x":8,"y":21.927},{"x":9,"y":130.303},{"x":10,"y":32.9315}],"page_file":[{"x":0,"y":360161000},{"x":1,"y":371139000},{"x":2,"y":352231000},{"x":3,"y":351072000},{"x":4,"y":355381000},{"x":5,"y":348778000},{"x":6,"y":341324000},{"x":7,"y":347894000},{"x":8,"y":321790000},{"x":9,"y":346337000},{"x":10,"y":342602000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6","dd02758f7260b26ff09403cb05547930ec9452a6db4ad1cdb02841b6f56c77a9","dac374375193ef49a4ea0aa5ba28458e488dd5bcf35a2bd0214ddd3a15ebe7fb","b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599","db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","da3ad32583644bd20116f0479c178f7c7c0b730728f4c02a438c0d19378c83d9","29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious — Falcon Sandbox Report 5de68fd5147c… — Score 100/100 — Sample 70cb1a8cb425… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 5de68fd5147c…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 54 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6/5de68fd5147c6120bb7d5d0c"}],["$","meta","4",{"property":"og:title","content":"Malicious — Falcon Sandbox Report 5de68fd5147c… — Score 100/100 — Sample 70cb1a8cb425… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 5de68fd5147c…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 54 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70cb1a8cb4259b72b704e81349c2ad5ac60cd1254a810ef68757f8c9409e3ea6/5de68fd5147c6120bb7d5d0c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious — Falcon Sandbox Report 5de68fd5147c… — Score 100/100 — Sample 70cb1a8cb425… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 5de68fd5147c…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 54 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]