26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious WinGo/Kryptik.ABQ trojan Sample bc16bad32a7a… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample bc16bad32a7a…. Malware family: WinGo/Kryptik.ABQ trojan. Threat score 86/100. 2/28 AV engines flagged this file. 14 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","keywords":["Malicious","WinGo/Kryptik.ABQ trojan","malware analysis","sandbox report","threat intelligence","bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da"],"about":{"@type":"SoftwareApplication","name":"glaicer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"WinGo/Kryptik.ABQ trojan","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9d4,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "glaicer.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "glaicer.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "glaicer.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "glaicer.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "glaicer.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")28:T8a1,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "glaicer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "glaicer.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTickCount64"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "glaicer.exe") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "glaicer.exe") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "glaicer.exe") Found reference to API "runtime._QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "glaicer.exe") Found reference to API "runtime._QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "glaicer.exe") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "glaicer.exe") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "glaicer.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTickCount64"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")29:Tb92,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")2a:T9db,"glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524137547 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524144126 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524373216 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524379490 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524551151 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524557871 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524884719 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1524891068 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1526710672 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1526717048 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1526901625 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1526908109 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1528066717 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1528075177 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1528941633 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1528948934 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530464279 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530470863 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530520173 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530526391 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530859293 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1530865860 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1532947052 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1532955102 [PID: 7216] "glaicer.exe" queried SystemProcessInformation at 00000000-00007216-00000C15-1533272445 [PID: 7216]2b:T7b75,Found api reference "goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuery{{continue}}block clauseFlood markersCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat ove" (Indicator: "CryptReleaseContext"; File: "glaicer.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pskip this directorybad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimeSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %s%*s %-*s %-*s %2dinvalid 0123456789aAbBcCdDeEfF_23283064365386962890625device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimetemplate %q not definedcannot assign nil to %sexpected bool; found %snon-function of type %sreflect.Value.Interfacereflect.Value.NumMethodindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad time" (Indicator: "CertGetCertificateChain"; File: "glaicer.exe") Found api reference "reflect.methodValueCall" not found in registryE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard TimeDestroyEnvironmentBlock0123456789abcdefABCDEF_function %q not defined", missing CPU supportNtQueryInformationThread116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWexpected float; found %sreflect.StructOf: field reflect.MapIter.SetValuereflect.Value.SetComplexreflect.Value.UnsafeAddrhash of unhashable type span has no free" (Indicator: "CertFreeCertificateChain"; File: "glaicer.exe") Found api reference "overflow on token GetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusfailed to find ConnectEx: invalid value; expected %sexpected integer; found %sexpected complex; found %stoo many slice indexes: %dnon-comparable type %s: %v using unaddressable valueunknown ABI parameter kind using zero Value argumentreflect.Value.MethodByNamereflect.Value.OverflowUintall goroutines stack tracecall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=freedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meentersyscall inconsistent inittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= : day-of-year out" (Indicator: "CertFreeCertificateContext"; File: "glaicer.exe") Found api reference "of rangeSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard TimeSetFileInformationByHandleunterminated quoted stringunexpected . after term %qAddVectoredExceptionHandlerxml: start tag with no namexml: opening charset %q: %w363797880709171295166015625channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreinvalid type for comparisonrange can't iterate over %vmap has no entry for key %qcan't index item of type %scan't slice item of type %sreflect.Value.OverflowFloatreflect.Value.UnsafePointer is not assignable to type PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedruntime" (Indicator: "CertEnumCertificatesInStore"; File: "glaicer.exe") Found api reference "stination address requiredprotocol driver not attachedCertCreateCertificateContext%q is not a defined functionnil pointer evaluating %s.%sinvalid slice index: %d > %dreflect.MakeSlice: len > capcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for [originating from goroutine English name for time zone "Canada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard Timereflect: In of non-func typereflect: Key of non-map typeabi.NewName: name too long: padding contained" (Indicator: "CertCreateCertificateContext"; File: "glaicer.exe"), Found api reference "nternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)unterminated character constantreflect: NumIn of non-func typeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadBytebufio: invalid use of UnreadRunebufio: tried to fill full bufferreflect: NumIn of non-func type MapIter.Value called before Nextreflect.Value.Grow: negative lenslice bounds out of range [::%x]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "glaicer.exe"), Found api reference "nternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)unterminated character constantreflect: NumIn of non-func typeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadBytebufio: invalid use of UnreadRunebufio: tried to fill full bufferreflect: NumIn of non-func type MapIter.Value called before Nextreflect.Value.Grow: negative lenslice bounds out of range [::%x]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "glaicer.exe"), Found api reference "goal cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcbad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuery{{continue}}block clauseFlood markersCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat ov" (Indicator: "CryptReleaseContext"; File: "glaicer.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pskip this directorybad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard TimeSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %s%*s %-*s %-*s %2dinvalid 0123456789aAbBcCdDeEfF_23283064365386962890625device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimetemplate %q not definedcannot assign nil to %sexpected bool; found %snon-function of type %sreflect.Value.Interfacereflect.Value.NumMethodindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channel) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksinvalid m->lockedInt = procresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad tim" (Indicator: "CertGetCertificateChain"; File: "glaicer.exe") Found api reference "reflect.methodValueCall" not found in registryE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard TimeDestroyEnvironmentBlock0123456789abcdefABCDEF_function %q not defined", missing CPU supportNtQueryInformationThread116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWexpected float; found %sreflect.StructOf: field reflect.MapIter.SetValuereflect.Value.SetComplexreflect.Value.UnsafeAddrhash of unhashable type span has no fre" (Indicator: "CertFreeCertificateChain"; File: "glaicer.exe") Found api reference "overflow on token GetFileInformationByHandle1455191522836685180664062572759576141834259033203125invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusfailed to find ConnectEx: invalid value; expected %sexpected integer; found %sexpected complex; found %stoo many slice indexes: %dnon-comparable type %s: %v using unaddressable valueunknown ABI parameter kind using zero Value argumentreflect.Value.MethodByNamereflect.Value.OverflowUintall goroutines stack tracecall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=freedefer with d.fn != nilforEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meentersyscall inconsistent inittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= : day-of-year ou" (Indicator: "CertFreeCertificateContext"; File: "glaicer.exe") Found api reference "nternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)unterminated character constantreflect: NumIn of non-func typeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadBytebufio: invalid use of UnreadRunebufio: tried to fill full bufferreflect: NumIn of non-func type MapIter.Value called before Nextreflect.Value.Grow: negative lenslice bounds out of range [::%x]slice bounds out o" (Indicator: "CertAddCertificateContextToStore"; File: "glaicer.exe") Found api reference "nternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)unterminated character constantreflect: NumIn of non-func typeunescaped < inside quoted string28421709430404007434844970703125resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadBytebufio: invalid use of UnreadRunebufio: tried to fill full bufferreflect: NumIn of non-func type MapIter.Value called before Nextreflect.Value.Grow: negative lenslice bounds out of range [::%x]slice bounds out o" (Indicator: "CertVerifyCertificateChainPolicy"; File: "glaicer.exe") Found api reference "runtime: sp=abi mismatchnot pollableRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQuery{{continue}}block clauseFlood markersCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from dalTLDpSugct?parsing time out of rangeGetTempPath2WModule32NextWunexpected %sdefine clauseempty commandRegDeleteKeyWRegEnumValueWGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [missing deferreturnpanic during mallocpanic holding lockspanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") Found api reference "NtQueryInformationThread116415321826934814453125582076609134674072265625connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWexpected float; found %sreflect.StructOf: field reflect.MapIter.SetValuereflect.Value.SetComplexreflect.Value.UnsafeAddrhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsbad defer entry in panicbypassed recovery failedstack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")2c:T690,"glaicer.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACjIacSdVVIS4vgNcCzz4yKEAAAABwAAABHAG8AbwBnAGwAZQAgAEMAaAByAG8AbQBlAAAAEGYAAAABAAAgAAAAK+80BUEQkr0463u3nXFfx4J8Q/Cre1vciUGql83r+qIAAAAADoAAAAACAAAgAAAA2dYKVXaxUdRXNBGRw77cryWL2LoBHpBISEpY2RfHOHQwAAAA+olyLvAoSSdWeZjopXrcIwnQ" "cchString": "392" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "25010000"} "glaicer.exe" called "CryptStringToBinaryA" with parameters {"pszString": "QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAAGm9GT9TTJlOqwm9l7Br4ykQAAAAHAAAAEcAbwBvAGcAbABlACAAQwBoAHIAbwBtAGUAAAAQZgAAAAEAACAAAAATxzbuD37qgDGNBSiyc36tuJgNLKmbDNVpFlDBnhOQXgAAAAAOgAAAAAIAACAAAACxgvTiyBD5osugMbupLhFBJINaYtdLrsgu3JGbJdg3F5ABAAAAUhCFvl9669LZqEqx06E1d7b0" "cchString": "860" "dwFlags": "1" "pbBinary": "APPB" "pcbBinary": "84020000"} "glaicer.exe" called "CryptStringToBinaryA" with parameters {"pszString": "RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjhxs/YzIRRKkv8Cq1fW8oEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJDBksyBBhAH3eNwj1p8nGPHP6S3XJ2HstPNjXWkQxwAAAAAAOgAAAAAIAACAAAADeHLXYbV+aGMM75ajrAgN+es57Lv0bD3+Z4t0YSwbpTzAAAABGh+NLNCVSLqf2GwDxEP7f" "cchString": "396" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "27010000"} "glaicer.exe" called "CryptStringToBinaryA" with parameters {"pszString": "QVBQQgEAAADQjJ3fARXREYx6AMBPwpfrAQAAAGm9GT9TTJlOqwm9l7Br4ykQAAAAHgAAAE0AaQBjAHIAbwBzAG8AZgB0ACAARQBkAGcAZQAAABBmAAAAAQAAIAAAAN/1feKT3lAY2lqOwBVvjefqulDyOFn1BmW1QzyzPRJPAAAAAA6AAAAAAgAAIAAAAN+nmjq3RyIkD9z36Q63tNqEJ25uWnGDS2qc0RY7S2vTUAEAAEkaT9m+iX+rRcMOzJTcv7na" "cchString": "776" "dwFlags": "1" "pbBinary": "APPB" "pcbBinary": "46020000"}2d:T410,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – cryptographic algorithms2e:Tea1,Found XOR loop in file "sample.bin" at offset 97138; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1491148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3355052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1429929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2550781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2646829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2669094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2692950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2699302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3539220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 174710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 215527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 256984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 352037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 381471; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 472654; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 472698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 834451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 834746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 834762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 835534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 835789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 835824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 836718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 836973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 837008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 893306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 893388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1776024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2165672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3341392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3344664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3360232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3440360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3473160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3639816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3727244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3799800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3807162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3842190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3970002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3974683; code bytes = 80302f:T4f9,file/memory contains long string with (Indicator: "GetCommandLine"; File: "glaicer.exe") Found string "syscall.GetCommandLine" (Indicator: "GetCommandLine"; File: "glaicer.exe") Found string "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; File: "glaicer.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007216-00000C2C-1525128010") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCommandLine"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")30:T68b,file/memory contains long string with (Indicator: "moz_cookies"; File: "akg_ff_4eece4.tmp") file/memory contains long string with (Indicator: "/cookies"; File: "test_output.zip") Found string "Browser/Cookies/%s_Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "%s\cookies.sqlite" (Indicator: "cookies.sqlite"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "moz_cookies" (Indicator: "moz_cookies"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "Games/Roblox/cookies.txt" (Indicator: "/cookies"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "AISessions/%s/Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "AISessions/ChatGPT/Cookies.txt" (Indicator: "/cookies"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp")31:T694,Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "AttemptToNotifyRunningChrome:SendMessage" (Indicator: "sendmessage"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found reference to API "Mojo.Channel.WriteSendMessageProcessType" (Indicator: "sendmessage"; Source: "00000000-00006248.00000000.215955.54CB1000.00000002.mdmp")32:T13b6,"glaicer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000004555fc7f000040303517d802000098e85f35e3000000060000000000000031e41d8cfc7f00000000000000000000000000000000000070e65f35e30000000000000000000000c0e55f35e300000010142e8cfc7f0000000000000000000090132e8cfc7f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060be1e8cfc7f0000c0e75f35e300000068403517d802000020403517d8020000c0d73417d80200000100000000000000e8c31d8cfc7f0000cf1b3517d802000007000000d8020000a03d3517d8020000f3851d8cfc7f0000a03d3517d80200000000000000000000d5d7c86a (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000697479223a2253616e746120436c617261222c22697370223a225a61796f2042616e647769647468222c227175657279223a2236342e3132342e31322e313632227d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000ac120ca0dc01000000000000000000000000fcfc00003134352e302e373633322e3735000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000010f79f36e300000000000000000000000000000000000000c0564985fc7f0000486eca74fc7f000001000000e30000001033208cfc7f00000a0c0000d802000098f89f36e300000001000000000000001800000001000000000000000000000000000000000000001d097d4c88660000bd6c066a6bfc000090f89f36e30000002d365155fc7f000000000000000000000000000000000000000000000000000004000000000000000000000004000000a0f79f36e300000001000000000000000100000000000000fd087d4c8866000060f89f36e3000000a8f89f36e3000000486eca74fc7f0000000000000000000000004685fc7f000000000000 (UID: 00000000-00007216) "glaicer.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216)33:T631,"glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYVERSION") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYVERSION") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYVERSION") "glaicer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME")34:T4c6,"glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM chrome.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM msedge.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM brave.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM opera.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM vivaldi.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM browser.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM yandex.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter "taskkill /F /IM firefox.exe" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" --no-startup-window --headless" - (UID: 00000000-00007216) "glaicer.exe" called "CreateProcessA" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless" - (UID: 00000000-00007216)35:Taf9,"glaicer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter KernelBase.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter cryptbase.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter nss3.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\softokn3.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Mozilla Firefox\freebl3.dll (UID: 00000000-00007216) "glaicer.exe" called "LoadLibrary" with a parameter %APPDATA%\Mozilla\Firefox\Profiles\5xz6ua91.default-release/nssckbi.dll (UID: 00000000-00007216)36:T34b5,"glaicer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __p__environ (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _set_new_mode (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _configthreadlocale (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __p___argc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __p___argv (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _configure_narrow_argv (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _crt_atexit (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _initialize_narrow_environment (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _seh_filter_exe (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _initterm_e (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _set_app_type (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter _set_invalid_parameter_handler (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __acrt_iob_func (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __stdio_common_vfprintf (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __stdio_common_vsprintf (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter __stdio_common_vsscanf (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter fflush (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter setvbuf (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter wvsprintfA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter QueryInterruptTime (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NSS_Init (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NSS_Shutdown (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter PK11SDR_Decrypt (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SECITEM_ZfreeItem (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NSC_GetInterface (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter NSC_ModuleDBFunc (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter FREEBL_GetVector (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00007216) "glaicer.exe" called "GetProcAddress" with a parameter CredFree (UID: 00000000-00007216)37:T1bf6,"in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesxml: %s.UnmarshalXML did not consume entire <%s> elementstrings: illegal use of non-zero Builder copied by valuenon-empty pointer map passed for non-pointer-size valuesreflect: Value.SetIterValue called on exhausted iteratorfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingin gcMark expecting to see gcphase as _GCmarkterminationcan't handle assignment of %s to empty interface argumentruntime: checkmarks found unexpected unmarked object obj=xml: unsupported version %q; only version 1.0 is supportedxml: encoding %q declared but Decoder.CharsetReader is nil%s field %q with tag %q conflicts with field %q with tag %qreflect: reflect.Value.Elem on an invalid notinheap pointerreflect: indirection through nil pointer to embedded structbytes.Reader.UnreadRune: previous operation was not ReadRunereflect: call of reflect.Value.Cap on ptr to non-array Valuereflect: call of reflect.Value." in Source: glaicer.exe "in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesxml: %s.UnmarshalXML did not consume entire <%s> elementstrings: illegal use of non-zero Builder copied by valuenon-empty pointer map passed for non-pointer-size valuesreflect: Value.SetIterValue called on exhausted iteratorfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingin gcMark expecting to see gcphase as _GCmarkterminationcan't handle assignment of %s to empty interface argumentruntime: checkmarks found unexpected unmarked object obj=xml: unsupported version %q; only version 1.0 is supportedxml: encoding %q declared but Decoder.CharsetReader is nil%s field %q with tag %q conflicts with field %q with tag %qreflect: reflect.Value.Elem on an invalid notinheap pointerreflect: indirection through nil pointer to embedded structbytes.Reader.UnreadRune: previous operation was not ReadRunereflect: call of reflect.Value.Cap on ptr to non-array Valuereflect: call of reflect.Value" in Source: glaicer.exe "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp 00000000-00007216.00000000.215265.40000000.00000040.mdmp 00000000-00007216.00000001.215774.40000000.00000040.mdmp38:T920,Process glaicer.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7216:304:WilStaging_02" Process glaicer.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7216:304:WilStaging_02" Process glaicer.exe created mutex with name "\BaseNamedObjects\40578b2b" Process glaicer.exe created mutex with name "Local\SM0:7216:304:WilStaging_02" Process glaicer.exe created mutex with name "SM0:7216:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3688:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3688:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:3688:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:3688:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4884:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4884:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:4884:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:4884:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7972:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7972:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:7972:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:7972:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2656:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:2656:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6140:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6140:304:WilStaging_02" Process taskkill.exe created mutex with name "SM0:6140:304:WilStaging_02" Process taskkill.exe created mutex with name "Local\SM0:6140:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4528:304:WilStaging_02" Process taskkill.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4528:304:WilStaging_02"39:T34d3,"SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00007216.00000000.215265.40000000.00000040.mdmp "internal error: polling on unsupported descriptor typeos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuereflect.FuncOf: last arg of variadic func must be slicemheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesxml: %s.UnmarshalXML did not consume entire <%s> elementstrings: illegal use of non-zero Builder copied by valuenon-empty pointer map passed for non-pointer-size valuesreflect: Value.SetIterValue called on exhausted iteratorfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingin gcMark expecting to see gcphase as _GCmarkterminationcan't handle assignment of %s to empty interface argumentruntime: checkmarks found unexpected unmarked object obj=xml: unsupported version %q; only version 1.0 is supportedxml: encoding %q declared but Decoder.CharsetReader is nil%s field %q with tag %q conflicts with field %q with tag %qreflect: reflect.Value.Elem on an invalid notinheap pointerreflect: indirection through nil pointer to embedded structbytes.Reader.UnreadRune: previous operation was not ReadRunereflect: call of reflect.Value.Cap on ptr to non-array Valuereflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: PostQueuedCompletionStatus failed (errno= runtime: GetQueuedCompletionStatusEx returned invalid mode= xml: EncodeToken of Directive containing wrong < or > markersreflect: wrong return count from function created by MakeFuncabiRegArgsType needs GC Prog, update methodValueCallFrameObjsreflect.ArrayOf: array size would exceed virtual address spacereflect: reflect.Value.Pointer on an invalid notinheap pointerfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_reflect.StructOf: struct size would exceed virtual address spaceruntime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultxml: name %q in tag of %s.%s conflicts with name %q in %s.XMLNameuser arena chunk size is not a multiple of the physical page sizeruntime.SetFinalizer: pointer not at beginning of allocated blockreflect: indirection through nil pointer to embedded struct field reflect: reflect.Value.UnsafePointer on an invalid notinheap pointerreflect: embedded interface with unexported method(s) not implementedbytes.Buffer: UnreadByte: previous operation was not a successful readtoo many concurrent operations on a single file or socket (max 1048575)reflect: embedded type with methods not implemented for non-pointer typebytes.Buffer: UnreadRune: previous operation was not a successful ReadRuneMapIter.Next called on an iterator that does not have an associated map Valuereflect: embedded type with methods not implemented if type is not first fieldcannot convert slice with length %y to array or pointer to array with length %xxml: end tag in namespace %s does not match start tag <%s> in namespace %sQueryPerformanceFrequency syscall returned zero, running on unsupported hardwarereflect: embedded type with methods not implemented if there is more than one fieldreflect.Value.Interface: cannot return value obtained from unexported field or methodreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)QueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedxml: EncodeToken of ProcInst xml target only valid for xml declaration, first token encodedruntime: warning: IsLongPathAwareProcess failed to enable long paths; proceeding in fixup mode" in Source: 00000000-00007216.00000001.215774.00D9C000.00000002.mdmp "sers\g5yxYMR\AppData\Roaming\BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp ":\Users\g5yxYMR\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "??\C:\Users\g5yxYMR\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp ":\Users\g5yxYMR\AppData\Local\Opera Software\Opera Stable" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp ":\Users\g5yxYMR\AppData\Local\Opera Software\Opera GX Stable" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "??\C:\Users\g5yxYMR\AppData\Local\Opera Software\Opera Stable" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "2448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "ER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007216.00000001.215774.17340000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\vmci" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera Stable" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Valve\Steam" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Valve\Steam\Users" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Microsoft\Office\%s\Outlook\Profiles\%s\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Roblox\RobloxStudioBrowser\roblox.com" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "Software\Roblox\RobloxPlayerBrowser\roblox.com" in Source: 00000000-00007216.00000001.215774.40000000.00000040.mdmp "SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings" in Source: 00000000-00007216.00000001.215774.546D7000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00007216.00000001.215774.546D7000.00000002.mdmp3a:Tbcb,"glaicer.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc55450000 "glaicer.exe" loaded module "KERNEL32.DLL" at base 7ffc8b090000 "glaicer.exe" loaded module "ADVAPI32.DLL" at base 7ffc8a010000 "glaicer.exe" loaded module "NTDLL.DLL" at base 7ffc8c1b0000 "glaicer.exe" loaded module "WINMM.DLL" at base 7ffc7ee20000 "glaicer.exe" loaded module "WS2_32.DLL" at base 7ffc8c0a0000 "glaicer.exe" loaded module "POWRPROF.DLL" at base 7ffc894a0000 "glaicer.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 7ffc89880000 "glaicer.exe" loaded module "USER32.DLL" at base 7ffc8aed0000 "glaicer.exe" loaded module "BCRYPT.DLL" at base 7ffc88eb0000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc896f0000 "glaicer.exe" loaded module "WINHTTP.DLL" at base 7ffc82560000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc86c00000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc6c4f0000 "glaicer.exe" loaded module "RPCRT4.DLL" at base 7ffc8b960000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc88a90000 "glaicer.exe" loaded module "SSPICLI.DLL" at base 7ffc88870000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc807a0000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc81490000 "glaicer.exe" loaded module "GDIPLUS.DLL" at base 7ffc74b40000 "glaicer.exe" loaded module "OLE32.DLL" at base 7ffc8bc80000 "glaicer.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffc74b40000 "glaicer.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffc85460000 "glaicer.exe" loaded module "KERNELBASE" at base 7ffc89c00000 "glaicer.exe" loaded module "CRYPT32.DLL" at base 7ffc89a90000 "glaicer.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffc86a60000 "glaicer.exe" loaded module "KERNELBASE.DLL" at base 7ffc89c00000 "glaicer.exe" loaded module "CRYPTBASE.DLL" at base 7ffc88d10000 "glaicer.exe" loaded module "NSS3.DLL" at base 7ffc54700000 "glaicer.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\SOFTOKN3.DLL" at base 7ffc645e0000 "glaicer.exe" loaded module "%PROGRAMFILES%\MOZILLA FIREFOX\FREEBL3.DLL" at base 7ffc54540000 "glaicer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffc886200003b:T409,Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00003688) Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00004884) Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00007972) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00002656) Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00006140) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00004528) Spawned process "taskkill.exe" with commandline "taskkill /F /IM yandex.exe" (UID: 00000000-00001744) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00003900) Spawned process "chrome.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00005068) Spawned process "msedge.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00006248)3c:T409,Spawned process "taskkill.exe" with commandline "taskkill /F /IM chrome.exe" (UID: 00000000-00003688) Spawned process "taskkill.exe" with commandline "taskkill /F /IM brave.exe" (UID: 00000000-00004884) Spawned process "taskkill.exe" with commandline "taskkill /F /IM msedge.exe" (UID: 00000000-00007972) Spawned process "taskkill.exe" with commandline "taskkill /F /IM opera.exe" (UID: 00000000-00002656) Spawned process "taskkill.exe" with commandline "taskkill /F /IM vivaldi.exe" (UID: 00000000-00006140) Spawned process "taskkill.exe" with commandline "taskkill /F /IM browser.exe" (UID: 00000000-00004528) Spawned process "taskkill.exe" with commandline "taskkill /F /IM yandex.exe" (UID: 00000000-00001744) Spawned process "taskkill.exe" with commandline "taskkill /F /IM firefox.exe" (UID: 00000000-00003900) Spawned process "chrome.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00005068) Spawned process "msedge.exe" with commandline "--no-startup-window --headless" (UID: 00000000-00006248)3d:Tec6,"akg_ff_4eece4.tmp" has type "SQLite 3.x database user version 12 (0xc) last written using SQLite version 3041002 page size 32768 writer version 2 read version 2 file counter 3 database pages 3 cookie 0x1 schema 4 UTF-8 version-valid-for 3"- Location: [%TEMP%\akg_ff_4eece4.tmp]- [targetUID: 00000000-00007216] "akg_4ee9c1_9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 41 database pages 129 1st free page 67 free pages 14 cookie 0x9b schema 4 UTF-8 version-valid-for 41"- Location: [%TEMP%\akg_4ee9c1_9.tmp]- [targetUID: 00000000-00007216] "akg_4ee9e0_a.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 41 database pages 51 1st free page 9 free pages 1 cookie 0x100 schema 4 UTF-8 version-valid-for 41"- Location: [%TEMP%\akg_4ee9e0_a.tmp]- [targetUID: 00000000-00007216] "akg_4ee1b4_5.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2"- Location: [%TEMP%\akg_4ee1b4_5.tmp]- [targetUID: 00000000-00007216] "akg_4ee1a5_4.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 5"- Location: [%TEMP%\akg_4ee1a5_4.tmp]- [targetUID: 00000000-00007216] "akg_4ee992_8.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 84 database pages 18 1st free page 16 free pages 7 cookie 0x21 schema 4 UTF-8 version-valid-for 84"- Location: [%TEMP%\akg_4ee992_8.tmp]- [targetUID: 00000000-00007216] "akg_4ee973_6.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 28 cookie 0x1c schema 4 UTF-8 version-valid-for 5"- Location: [%TEMP%\akg_4ee973_6.tmp]- [targetUID: 00000000-00007216] "akg_4ee983_7.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_4ee983_7.tmp]- [targetUID: 00000000-00007216] "test_output.zip" has type "Zip archive data made by v2.0 extract using at least v2.0 last modified Oct 26 2026 14:15:00 uncompressed size 2305 method=deflate"- Location: [C:\test_output.zip]- [targetUID: 00000000-00007216] "akg_4ee185_1.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_4ee185_1.tmp]- [targetUID: 00000000-00007216] "akg_4ee195_3.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7"- Location: [%TEMP%\akg_4ee195_3.tmp]- [targetUID: 00000000-00007216] "akg_debug.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\akg_debug.txt]- [targetUID: 00000000-00007216] "~DF2c18.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF2c18.tmp]- [targetUID: 00000000-00007216] "akg_4ee185_2.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%TEMP%\akg_4ee185_2.tmp]- [targetUID: 00000000-00007216] "~DF3cb6.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF3cb6.tmp]- [targetUID: 00000000-00007216] "~DF787d.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF787d.tmp]- [targetUID: 00000000-00007216] "~DF709a.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\~DF709a.tmp]- [targetUID: 00000000-00007216]3e:Tb90,"akg_ff_4eece4.tmp" has type "SQLite 3.x database user version 12 (0xc) last written using SQLite version 3041002 page size 32768 writer version 2 read version 2 file counter 3 database pages 3 cookie 0x1 schema 4 UTF-8 version-valid-for 3" - Location: [%TEMP%\akg_ff_4eece4.tmp] "akg_4ee9c1_9.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 41 database pages 129 1st free page 67 free pages 14 cookie 0x9b schema 4 UTF-8 version-valid-for 41" - Location: [%TEMP%\akg_4ee9c1_9.tmp] "akg_4ee9e0_a.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 41 database pages 51 1st free page 9 free pages 1 cookie 0x100 schema 4 UTF-8 version-valid-for 41" - Location: [%TEMP%\akg_4ee9e0_a.tmp] "akg_4ee1b4_5.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2" - Location: [%TEMP%\akg_4ee1b4_5.tmp] "akg_4ee1a5_4.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 5" - Location: [%TEMP%\akg_4ee1a5_4.tmp] "akg_4ee992_8.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 84 database pages 18 1st free page 16 free pages 7 cookie 0x21 schema 4 UTF-8 version-valid-for 84" - Location: [%TEMP%\akg_4ee992_8.tmp] "akg_4ee973_6.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 5 database pages 28 cookie 0x1c schema 4 UTF-8 version-valid-for 5" - Location: [%TEMP%\akg_4ee973_6.tmp] "akg_4ee983_7.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_4ee983_7.tmp] "akg_4ee185_1.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_4ee185_1.tmp] "akg_4ee195_3.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7" - Location: [%TEMP%\akg_4ee195_3.tmp] "~DF2c18.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF2c18.tmp] "akg_4ee185_2.tmp" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1" - Location: [%TEMP%\akg_4ee185_2.tmp] "~DF3cb6.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF3cb6.tmp] "~DF787d.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF787d.tmp] "~DF709a.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\~DF709a.tmp]3f:T4b6,"glaicer.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TASKKILL.EXE"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "")40:T9c0,"glaicer.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\THEMES\PERSONALIZE"; Key: "APPSUSELIGHTTHEME"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "673CF800-208A-5327-3F4B-2BE44A66627A"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "PRODUCTNAME"; Value: "")41:T56f,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to perform anti-VM checks using CPUID Matched sigs: Able to detect sandbox environment via user account Matched sigs: Able to identify virtual environment using sandbox registry Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Attempts to identify external IP address Matched sigs: The input sample contains the RDTSCP instruction42:T7e9,"glaicer.exe" trying to access non-existent file "\Device\RasAcd" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\Application" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_1.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_2.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee195_3.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1a5_4.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1b4_5.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee973_6.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee983_7.tmp-wal" "glaicer.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-wal"43:T843,file/memory contains long string with (Indicator: "WSARecv"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WSASend"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "glaicer.exe") Found reference to API "syscall.WSASendto" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.WSARecvFrom" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.WSASendMsg" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.WSARecvMsg" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1.1" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WSARecv"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "WSASend"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "WSAStartup"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")44:T8b3,file/memory contains long string with (Indicator: "WSARecv"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WSASend"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "glaicer.exe") Found reference to API "syscall.WSASendto" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.WSARecvFrom" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.WSASendMsg" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.WSARecvMsg" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1.1" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; File: "glaicer.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; File: "glaicer.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "glaicer.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007216-00000C2C-1525099475") file/memory contains long string with (Indicator: "WSARecv"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "WSASend"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "WSAStartup"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")45:Ta5c,file/memory contains long string with (Indicator: "wsastartup"; File: "glaicer.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "glaicer.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "glaicer.exe") file/memory contains long string with (Indicator: " send "; File: "glaicer.exe") file/memory contains long string with (Indicator: " recv "; File: "glaicer.exe") file/memory contains long string with (Indicator: " socket "; File: "glaicer.exe") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "glaicer.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; File: "glaicer.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007216-00000C2C-1525099475") Found reference to API "a protocol buffer. Use the 'bytes' type if you intend to send raw bytes." (Indicator: " send "; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "--url=URL send crash reports to this Breakpad server URL," (Indicator: " send "; Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found reference to API "a protocol buffer. Use the 'bytes' type if you intend to send raw bytes." (Indicator: " send "; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found reference to API "--url=URL send crash reports to this Breakpad server URL," (Indicator: " send "; Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: " recv "; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: " socket "; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")46:Tfce,Found URL "https://clients2.google.com/cr/report%08x%x00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899getsystemtimepreciseasfiletime__next_prime" - Source: "00000000-00005068.00000000.215890.54F3D000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp") Found URL "https://watson.telemetry.microsoft.comoftware\microsoft\sqmclient\windows\commondatapoints807310433457345724575929012728system\currentcontrolset\control\systeminformationsystemmanufacturerbiosversionsystemproductnamecomputerhardwareidhardware\description\system\centralprocessor\0" - Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found URL "https://nw-umwatson.events.data.microsoft.com/telemetry.requestapplication/xmlcontent-typecontent-lengthmsa_deviceticketapplication/x-binarywerreportmetadataprocess_idprocessinformationimagenamecmdlinesignatureuptimewow64iptenabledprocessmetadataproblemsignatureseventtypeparameter%04d-%02d-%02dt%02d:%02d:%02dzreportinformationguidsourcecreationtimememorymini..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.ccgetfileattributes" - Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/" - Source: "00000000-00006248.00000000.215955.5048F000.00000002.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp") Found URL "https://kkeyyou.cc/kkeyyou.cckkeyyou.cccpip6tcpippschedvmbusafunixrfcomm\lrpc-22b40117141738f307??\c:\windows\system32\winnlsres.dllc6bd0dd-478b-4f90-ba1c-343eeaad316bkkeyyou.cc:\windows\system32\sspicli.dllnsresolvererberosredssp.dllredsspegotiatecalrpckeyyou.ccpmappercalrpcku2upmappersasspirpckeyyou.ccsssppmappersasspirpckeyyou.ccloudapu.ccdigestkeyyou.cctsvcscalrpcpmapperkeyyou.ccchannelaldll:\users\g5yxymr\appdata\local\temp??\c:\program" - Source: "00000000-00007216.00000000.215265.17340000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/handshakekkeyyou.cckkeyyou.ccystem\currentcontrolset\services\tcpip6\parameters\winsockystem\currentcontrolset\services\tcpip\parameters\winsock??\c:\windows\globalization\sorting\sortdefault.nlstcpipkkeyyou.cckkeyyou.ccc:\windows\system320000kkeyyou.cckkeyyou.cc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c:\windo\g5yxymr\appdata\local\temp\roductnamensresolver486,4912,3,nindex,0,0,,111097637486,4912,3,$apireturn,1,0,,0common" - Source: "00000000-00007216.00000000.215265.17340000.00000004.mdmp") Found URL "https://kkeyyou.cc/gate/handshakec:\glaicer.exehmen" - Source: "00000000-00007216.00000000.215265.17340000.00000004.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00007216.00000000.215265.40000000.00000040.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00007216.00000000.215265.40000000.00000040.mdmp") Found URL "http://www.w3.org/xml/1998/namespacexml:" - Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found URL "http://www.mozilla.com/en-us/blocklist/compile-time" - Source: "00000000-00007216.00000001.215774.546D7000.00000002.mdmp")47:T41f,Found registry query API: "RegOpenKey (in long string)" in file "glaicer.exe" Found registry query API: "RegEnumValue (in long string)" in file "glaicer.exe" Found registry query API: "RegQueryValue (in long string)" in file "glaicer.exe" Found registry query API: "syscall.RegOpenKeyEx" in file "glaicer.exe" Found registry query API: "syscall.RegQueryValueEx" in file "glaicer.exe" Found registry query API: "syscall.RegEnumKeyEx" in file "glaicer.exe" Found registry query API: "syscall.procRegEnumKeyExW" in file "glaicer.exe" Found registry query API: "syscall.procRegOpenKeyExW" in file "glaicer.exe" Found registry query API: "syscall.procRegQueryValueExW" in file "glaicer.exe" Found registry query API: "RegOpenKey (in long string)" in "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp" Found registry query API: "RegEnumValue (in long string)" in "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp"48:T8a4,Found string "encoding/base64" (Indicator: "base64"; File: "glaicer.exe") Found string "*base64.Encoding" (Indicator: "base64"; File: "glaicer.exe") Found string "*base64.CorruptInputError" (Indicator: "base64"; File: "glaicer.exe") file/memory contains long string with (Indicator: "aes"; File: "glaicer.exe") file/memory contains long string with (Indicator: "base64"; File: "glaicer.exe") file/memory contains long string with (Indicator: "base64"; File: "akg_4ee9c1_9.tmp") file/memory contains long string with (Indicator: "aes"; File: "akg_4ee1b4_5.tmp") file/memory contains long string with (Indicator: "base64"; File: "akg_4ee1a5_4.tmp") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "glaicer.exe") Found string "aeshashbody" (Indicator: "aes"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).Encode" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).EncodeToString" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).EncodedLen" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.CorruptInputError.Error" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).decodeQuantum" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).DecodeString" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).DecodedLen" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*Encoding).Decode" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.assemble64" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.assemble32" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.init" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.NewEncoding" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.Encoding.WithPadding" (Indicator: "base64"; File: "glaicer.exe") Found string "type:.eq.encoding/base64.Encoding" (Indicator: "base64"; File: "glaicer.exe") Found string "encoding/base64.(*CorruptInputError).Error" (Indicator: "base64"; File: "glaicer.exe")49:T5ba,file/memory contains long string with (Indicator: "FindNextFile"; File: "glaicer.exe") file/memory contains long string with (Indicator: "FindFirstFile"; File: "glaicer.exe") Found reference to API "syscall.FindFirstFile" (Indicator: "FindFirstFile"; File: "glaicer.exe") Found reference to API "syscall.FindNextFile" (Indicator: "FindNextFile"; File: "glaicer.exe") Found reference to API "syscall.procFindFirstFileW" (Indicator: "FindFirstFile"; File: "glaicer.exe") Found reference to API "syscall.procFindNextFileW" (Indicator: "FindNextFile"; File: "glaicer.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")4a:Tb07,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Process32First"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Module32First"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "glaicer.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "glaicer.exe") Found reference to API "ProcessList.txt" (Indicator: "ProcessList"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.545E4000.00000002.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp, 00000000-00007216.00000001.215774.6461B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.545E4000.00000002.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp, 00000000-00007216.00000001.215774.6461B000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")4b:Tc8a,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "glaicer.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "glaicer.exe") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "internal/poll.(*FD).GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "internal/poll.(*FD).GetFileInformationByHandle.func1" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "syscall.procGetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "glaicer.exe") Found reference to API "syscall.procGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "internal/syscall/windows.procGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "glaicer.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp, 00000000-00007216.00000001.215774.6461B000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTempPath"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")4c:T47d,Found string "\Device\HarddiskVolume3\Windows\System32\taskkill.exe" (Indicator: "\Device\"; Source: "00000000-00007216-00000BC0-1531256618") Found string "\Device\HarddiskVolume3\Program Files\Google\Chrome\Application\chrome.exe" (Indicator: "\Device\"; Source: "00000000-00007216-00000BC0-1533534237") Found string "\Device\HarddiskVolume3\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Indicator: "\Device\"; Source: "00000000-00007216-00000BC0-1534594214") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000000.215265.18E10000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.18E10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000000.215265.18E10000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.18E10000.00000004.mdmp")4d:T5f7,file/memory contains long string with (Indicator: "CopySid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") Found reference to API "time: bad [0-9]*DuplicateTokenExRtlVirtualUnwindunclosed commentGODEBUG: value "unexpected score" (Indicator: "DuplicateToken"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp"), Found reference to API "time: bad [0-9]*DuplicateTokenExRtlVirtualUnwindunclosed commentGODEBUG: value "unexpected score" (Indicator: "DuplicateTokenEx"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")4e:T62d,Found string "IfaceIndir" (Indicator: "iface"; File: "glaicer.exe") Found string "avguard.exe" (Indicator: "avguard"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "avgnt.exe" (Indicator: "avgnt"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "navapsvc.exe" (Indicator: "navapsvc"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "Norton" (Indicator: "norton"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "mcshield.exe" (Indicator: "mcshield"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "McAfee" (Indicator: "mcafee"; Source: "00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp") Found string "IfaceIndir" (Indicator: "iface"; Source: "00000000-00007216.00000001.215774.00D9C000.00000002.mdmp")4f:T9a1,"glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\TASKKILL.EXE"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: ""), "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")50:T98c,"glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF787d.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF2c18.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF3cb6.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF709a.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_1.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_1.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_2.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee185_2.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee195_3.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee195_3.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1a5_4.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1a5_4.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1b4_5.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee1b4_5.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee973_6.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee973_6.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee983_7.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee983_7.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee992_8.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee992_8.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee9c1_9.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee9c1_9.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee9e0_a.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_4ee9e0_a.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_ff_4eece4.tmp" with delete access51:Tb40,"glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1028) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1028) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1036) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1036) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 720) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 720) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 708) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 708) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 980) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 980) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 680) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 680) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1048) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1032) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1032) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 720) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 720) "glaicer.exe" wrote 00003600 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 720) "glaicer.exe" wrote 00000010 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 720) "glaicer.exe" wrote 00000338 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 720) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1052) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1052) "glaicer.exe" wrote 00003600 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1052) "glaicer.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1052) "glaicer.exe" wrote 00000338 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1052)52:T71e,"glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal"53:T143d,"glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\pkcs11.txt" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\logins.json" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txt" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\logins.json" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FlashFXP\Sites.dat" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000005.ldb" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data-wal"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1793052157058,"unified_at":"2026-10-26T22:02:37.058Z","metadata":{"hashes":{"sha256":"bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","sha1":"c74a200094d791db8677749580fd7c0654922f8e","md5":"73e53595593b6b687f041c8e107f4165","sha512":"ce8de8cf243bc9a293684588138bb22c003b5848fb612f097ddc3edc4722617f9e5f4b1efd3ceda87ae90e5f916422a2d0ac3e0de702c535989278d3e6406e00","ssdeep":"49152:djEUAG3Ac3Mos+IGrsX8kjjLjst0/nhxP0QXqCeYP:REBGQcSQrsX8k7jst0/N5","ssdeep_chunks":["49152:djEUAG3","49152:jEUAG3A","49152:EUAG3Ac","49152:UAG3Ac3","49152:AG3Ac3M","49152:G3Ac3Mo","49152:3Ac3Mos","49152:Ac3Mos+","49152:c3Mos+I","49152:3Mos+IG","49152:Mos+IGr","49152:os+IGrs","49152:s+IGrsX","49152:+IGrsX8","49152:IGrsX8k","49152:GrsX8kj","49152:rsX8kjj","49152:sX8kjjL","49152:X8kjjLj","49152:8kjjLjs","49152:kjjLjst","49152:jjLjst0","49152:jLjst0/","49152:Ljst0/n","49152:jst0/nh","49152:st0/nhx","49152:t0/nhxP","49152:0/nhxP0","49152:/nhxP0Q","49152:nhxP0QX","49152:hxP0QXq","49152:xP0QXqC","49152:P0QXqCe","49152:0QXqCeY","49152:QXqCeYP","98304:djEUAG3","98304:jEUAG3A","98304:EUAG3Ac","98304:UAG3Ac3","98304:AG3Ac3M","98304:G3Ac3Mo","98304:3Ac3Mos","98304:Ac3Mos+","98304:c3Mos+I","98304:3Mos+IG","98304:Mos+IGr","98304:os+IGrs","98304:s+IGrsX","98304:+IGrsX8","98304:IGrsX8k","98304:GrsX8kj","98304:rsX8kjj","98304:sX8kjjL","98304:X8kjjLj","98304:8kjjLjs","98304:kjjLjst","98304:jjLjst0","98304:jLjst0/","98304:Ljst0/n","98304:jst0/nh","98304:st0/nhx","98304:t0/nhxP","98304:0/nhxP0","98304:/nhxP0Q","98304:nhxP0QX","98304:hxP0QXq","98304:xP0QXqC","98304:P0QXqCe","98304:0QXqCeY","98304:QXqCeYP","49152:REBGQcS","49152:EBGQcSQ","49152:BGQcSQr","49152:GQcSQrs","49152:QcSQrsX","49152:cSQrsX8","49152:SQrsX8k","49152:QrsX8k7","49152:rsX8k7j","49152:sX8k7js","49152:X8k7jst","49152:8k7jst0","49152:k7jst0/","49152:7jst0/N","49152:jst0/N5"],"imphash":"4f2f006e2ecf7172ad368f8289dc96c1"},"file_info":{"file_name":"glaicer.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3977128,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793047856000,"last_seen":1793047856000,"last_multi_scan":1793047856000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":["infostealer","evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":93},"sandbox_signatures":{"informative_count":212,"suspicious_count":12,"malicious_count":14,"total":238},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.ABQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"WinGo/Kryptik.ABQ trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"},{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Contains AI service credential strings"},{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Able to perform anti-VM checks using CPUID"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads VM-specific registry key"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to detect sandbox environment via user account"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Observed security product related strings in binary/memory"},{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Able to identify virtual environment using sandbox registry"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Run Virtual Instance","attack_id":"T1564.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/006","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"\nSetsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"\nSetsockoptInt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\t*xml.name\", Heuristic match: \"*[]xml.name\", Heuristic match: \"\t*abi.name\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\" Go build ID: \"H54Bsp4O9Bq46e7quHCL/DvRb3DIB3U0HwIZbS5pO/BeotkBIzSyqOOxSS7Efo/KIwjU2diWWLrNKyaZ7C7\"\n \" (Indicator: \" Go build ID: \"H54Bsp4O9Bq46e7quHCL/DvRb3DIB3U0HwIZbS5pO/BeotkBIzSyqOOxSS7Efo/KIwjU2diWWLrNKyaZ7C7\"\n )\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-74","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"Software\\Valve\\Steam\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"Software\\Valve\\Steam\\Users\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"%s\\config\\loginusers.vdf\" (Indicator: \"config\\loginusers.vdf\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"glaicer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"glaicer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"glaicer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HMAC\"; File: \"akg_4ee9e0_a.tmp\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"glaicer.exe\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Oid\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007216.00000000.215265.40000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 7E890000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"glaicer.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"glaicer.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"taskkill.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"glaicer.exe\")\n Found reference to API \"runtime._QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"glaicer.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"encoding/base64.(*Encoding).DecodeString\" (Indicator: \".decodestring\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n 02h in Stream UID: 52270-5379-00449E20\n Assembly shows XOR instruction xor eax\n 02h in Stream UID: 52270-5379-00449E20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\Mozilla Firefox\\softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00007216-00000C2B-1536186899\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00007216-00000C66-1536241437\")\n Found string \"%PROGRAMFILES%\\Mozilla Firefox\\freebl3.dll\" (Indicator: \"\\freebl3.dll\"; Source: \"00000000-00007216-00000C2B-1536250388\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"city\" in header \"GET /json/?fields=query,countryCode,city,isp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0Host: ip-api.com\"\n Contains base64 string in header \"Keep\" in header \"GET /json/?fields=query,countryCode,city,isp HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0Host: ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"akg_4ee9e0_a.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_4ee992_8.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_4ee195_3.tmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"Found string \"WDAGUtilityAccount\" (Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n file/memory contains long string(Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SOFTWARE\\VMware, Inc.\\VMware Tools\" (Indicator: \"software\\vmware, inc.\\vmware tools\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Indicator: \"software\\oracle\\virtualbox guest additions\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters\" (Indicator: \"software\\microsoft\\virtual machine\\guest\\parameters\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform anti-VM checks using CPUID","description":"Found string \"KVMKVMKVM\" (Indicator: \"kvmkvmkvm\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":3,"id":"string-674","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$30","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"glaicer.exe\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"glaicer.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"glaicer.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"glaicer.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"glaicer.exe\"\n Found system information discovery API: \"internal/syscall/windows/registry.procExpandEnvironmentStringsW\" in file \"glaicer.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"glaicer.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"glaicer.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"glaicer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"glaicer.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"glaicer.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"glaicer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"glaicer.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"glaicer.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"glaicer.exe\")\n Found reference to API \"runtime._GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"glaicer.exe\" queried token user identity (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1526840646\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1526846616\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1530320042\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1536315168\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1536579730\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007216-00000C17-1536714743","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$33","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"glaicer.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"glaicer.exe\"\n Found registry modification API: \"internal/syscall/windows/registry.LoadRegLoadMUIString\" in file \"glaicer.exe\"\n Found registry modification API: \"internal/syscall/windows/registry.procRegLoadMUIStringW\" in file \"glaicer.exe\"\n Found registry modification API: \"RegCreateKey (in long string)\" in \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"glaicer.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"glaicer.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft (UID: 00000000-00007216)\n \"glaicer.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft\\Vault (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"glaicer.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_dee3654b_1c30\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00007216)\n \"glaicer.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_dee35ced_1c30\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"glaicer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_dee3654b_1c30\" - (UID: 00000000-00007216)\n \"glaicer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_dee35ced_1c30\" - (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"glaicer.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"glaicer.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"glaicer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"glaicer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"glaicer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"glaicer.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$38","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"glaicer.exe\" failed to load missing module \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release/nssckbi.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"glaicer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT %lu.%lu; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\akg_dee3654b_1c30\n Found string - \\\\.\\pipe\\akg_dee35ced_1c30\n Found string - \\\\.\\pipe\\akg_%lx_%lx","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https_discordapp.com_0\" (Indicator: \"discordapp.com\")\n \"discordapp.com\" (Indicator: \"discordapp.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\" Response ==> HTTP/1.1 200 OK\nDate: Mon\n 26 Oct 2026 20:51:29 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 88\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553222C2263697479223A2253616E746120436C617261222C22697370223A225A61796F2042616E647769647468222C.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00005068)\n Launches browser \"msedge.exe\" (UID: 00000000-00006248)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7BB00000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"glaicer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 896F0000\n \"glaicer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 88EB0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 896F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"glaicer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8B960000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8B960000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"glaicer.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"glaicer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"glaicer.exe\" has an writable section named \".data\"\n \"glaicer.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"glaicer.exe\" file has an entrypoint instructions - \"jmp\t0x462120,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1eb000\" greater than 0x100000\n Raw size of \".rdata\" is \"0x18f400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1eaeac\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x18f358\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" [Source: 00000000-00007216-00000BC0-1531256618]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\taskkill.exe\" [Source: 00000000-00007216-00000BC0-1531259130]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00003688) was launched with new environment variables: \"USERDNSDOMAIN=\"DsbGwRB4HzvwNMd\"\"\n Process \"taskkill.exe\" (UID: 00000000-00003688) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"\n \"kkeyyou.cc\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 407689)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Delta Terra Ventures, O=Delta Terra Ventures, C=US\" (SHA1: 37:CD:E5:25:48:31:39:E2:AD:79:92:F8:46:29:5D:9B:3D:71:0C:05; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"glaicer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\akg_debug.txt\"\n \"glaicer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF787d.tmp\"\n \"glaicer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF2c18.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"glaicer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$3e","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"glaicer.exe\" queries basic process information of the \"C:\\glaicer.exe\" (UID: 7216)\n \"glaicer.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 7216)\n \"glaicer.exe\" queries basic process information of the \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 7216)\n \"glaicer.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 7216)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 3688)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 4884)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 7972)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data for account\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\network\\cookies\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\web data\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$41","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"glaicer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\glaicer.exe\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"glaicer.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"glaicer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"glaicer.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\winhttp.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\webio.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\winnlsres.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\SspiCli.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\WindowsCodecs.dll\"\n \"glaicer.exe\" trying to access non-existent file \"C:\\taskkill.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"glaicer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\akg_debug.txt\"\n \"glaicer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\~df787d.tmp\"\n \"glaicer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\~df2c18.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"glaicer.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp, 00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00006248.00000000.215955.5048F000.00000002.mdmp, 00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"glaicer.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2d81737a990\"\n \"dwHeadersLength\": \"0\"\n \"lpOptional\": \"4897fcc446cd93dd566259a13f139083b3a0cb194dfb49c4fbfe6471347d732b\"\n \"dwOptionalLength\": \"32\"\n \"dwTotalLength\": \"32\"\n \"dwContext\": \"0\"\n \"$error\": \"2ee7\"}\n \"glaicer.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2d8173bac60\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2d8173bac60\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /json/?fields=query,countryCode,city,isp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"glaicer.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; Source: \"00000000-00005068.00000000.215890.C8AB3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"akg_4ee9e0_a.tmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"\n \"192.168.0.2\"\n \"0.0.0.0\"\n \"0.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/?fields=query\ncountryCode\ncity\nisp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"FTP/WinSCP/Sessions.txt\" (Indicator: \"winscp\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005068.00000000.215890.62940000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007216.00000000.215265.17340000.00000004.mdmp, 00000000-00007216.00000001.215774.17340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"akg_4ee973_6.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_4ee983_7.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_4ee185_1.tmp\")\n Found string \"%s\\1password\\data\" (Indicator: \"1password\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00005068.00000000.215890.54F3D000.00000002.mdmp\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00006248.00000000.215955.54CB1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"glaicer.exe\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetUserName\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"glaicer.exe\" called \"FindFirstFileA\" with parameter %PROGRAMFILES%\\* (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindNextFileA\" with parameter .. (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindNextFileA\" with parameter Common Files (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindNextFileA\" with parameter desktop.ini (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindNextFileA\" with parameter Google (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindFirstFileA\" with parameter %LOCALAPPDATA%\\Google\\Chrome\\Application\\* (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindFirstFileA\" with parameter %PROGRAMFILES%\\Google\\Chrome\\Application\\* (UID: 00000000-00007216)\n \"glaicer.exe\" called \"FindNextFileA\" with parameter 145.0.7632.75 (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"glaicer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"glaicer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"glaicer.exe\" called \"GetComputerNameA\" (UID: 00000000-00007216)\n \"glaicer.exe\" called \"GetComputerNameW\" (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"glaicer.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains AI service credential strings","description":"Found string \"%s\\.codex\\auth.json\" (Indicator: \".codex\\auth.json\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"%s\\.codex\\config.toml\" (Indicator: \".codex\\config.toml\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":3,"id":"string-1001","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$48","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"runtime.getGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"glaicer.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.545E4000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00007216-00000C2D-30211506146\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"%s\\1password\\data\" (Indicator: \"password\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"Mails/Thunderbird/passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\%s\\Outlook\\Profiles\\%s\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp\n 00000000-00007216.00000000.215265.40000000.00000040.mdmp\n 00000000-00007216.00000001.215774.40000000.00000040.mdmp\n \"%s\\Thunderbird\\Profiles\" in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp\n 00000000-00007216.00000000.215265.40000000.00000040.mdmp\n 00000000-00007216.00000001.215774.40000000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp\n 00000000-00007216.00000000.215265.40000000.00000040.mdmp\n 00000000-00007216.00000001.215774.40000000.00000040.mdmp\n \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007216.00000000.215265.00180000.00000004.mdmp\n 00000000-00007216.00000000.215265.40000000.00000040.mdmp\n 00000000-00007216.00000001.215774.40000000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Vault\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00007216-00000C3E-30285950164\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"glaicer.exe\")\n Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"route\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"Found string -csfalconservice.exe\n Found string -CrowdStrike Falcon","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"%s\\logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"Browser/%s/%s/logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"%s\\key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")\n Found string \"Browser/%s/%s/key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/Connections.txt\" (Indicator: \"connections.txt\")\n \"%s\\SmartFTP\\Client 2.0\\Favorites\" (Indicator: \"\\smartftp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"AISessions/AWS/credentials\" (Indicator: \"aws/credentials\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"glaicer.exe\"\n Found registry deletion API: \"RegDeleteKey (in long string)\" in \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"glaicer.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"glaicer.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.545E4000.00000002.mdmp, 00000000-00007216.00000001.215774.546D7000.00000002.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp, 00000000-00007216.00000001.215774.6461B000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"glaicer.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007216.00000000.215265.00180000.00000004.mdmp, 00000000-00007216.00000000.215265.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.40000000.00000040.mdmp, 00000000-00007216.00000001.215774.548F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"glaicer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"E07CB77A8F65DD010000000000000000000000000200000000\")\n \"glaicer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1685","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"glaicer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"glaicer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"E07CB77A8F65DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007216.00000001.215774.00D9C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ungetc\" (Source: glaicer.exe, API is part of module: MSVCRT.DLL)\n Found string \"accept\" (Source: glaicer.exe, API is part of module: WS2_32.DLL)\n Found string \"remove\" (Source: glaicer.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: glaicer.exe, API is part of module: WS2_32.DLL)\n Found string \"unexpected\" (Source: glaicer.exe, API is part of module: VCRUNTIME140.DLL)\n Found string \"GetFileType\" (Source: glaicer.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: glaicer.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"glaicer.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007216-00000BC0-1531256618\")\n Found string \"%WINDIR%\\SYSTEM32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007216-00000BC0-1531259130\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ORACLE VM VIRTUALBOX GUEST ADDITIONS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/27 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"glaicer.exe\" reads file \"C:\\Windows\\system.ini\"\n \"glaicer.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"glaicer.exe\" writes archive file \"C:\\test_output.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$50","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetUserNameA@ADVAPI32.DLL\" in \"glaicer.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetProcAddress\n GetSystemInfo\n LoadLibraryW\n VirtualAlloc\n GetSystemDirectoryA\n CreateFileA\n CreateThread\n LoadLibraryExW\n GetThreadContext","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"glaicer.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00003900)\n Process \"chrome.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00005068)\n Process \"msedge.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00006248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"glaicer.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"720\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"2922230583696\"\n \"lpParameter\": \"2922230593024\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}\n \"glaicer.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"1052\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"1795083473296\"\n \"lpParameter\": \"1795083482624\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"glaicer.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window --headless\" - (UID: 00000000-00007216)\n \"glaicer.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --headless\" - (UID: 00000000-00007216)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00003688)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00004884)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00007972)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00002656)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00006140)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00004528)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00001744)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00003900)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The signature of the certificate cannot be verified. (0x80096004)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$51","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on process \"00000000-00007216\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$52","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"\"glaicer.exe\" called \"CredEnumerateA\" with parameters {\"Filter\": \"TERMSRV/*\"\n \"Flags\": \"0\"\n \"Count\": \"00000000\"\n \"Credential\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\"}","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"glaicer.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$53","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"glaicer.exe\" (UID: 00000000-00007216)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00003688)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00004884)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00007972)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00002656)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00006140)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00004528)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00001744)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00003900)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"intel_graph":{"map":{"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"Domain:kkeyyou.cc":{"type":"Domain","value":"kkeyyou.cc"},"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b":{"type":"File","value":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c":{"type":"File","value":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247":{"type":"File","value":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},"File:27ba9642cae974600f2906493d367fe022c7cc079d6772c0ebbc607bacc00de7":{"type":"File","value":"27ba9642cae974600f2906493d367fe022c7cc079d6772c0ebbc607bacc00de7"},"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3":{"type":"File","value":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c":{"type":"File","value":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af":{"type":"File","value":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},"File:896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7":{"type":"File","value":"896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc":{"type":"File","value":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314":{"type":"File","value":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da":{"type":"File","value":"bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","filetype":"PE32+ executable for MS Windows 6.01 (GUI), x86-64, 8 sections","filetype_short":"PE64"},"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532":{"type":"File","value":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813":{"type":"File","value":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5":{"type":"File","value":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},"File:e429653caa5921a58f4d6810282f7a625575c56f67763220de93c7af55f89393":{"type":"File","value":"e429653caa5921a58f4d6810282f7a625575c56f67763220de93c7af55f89393"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/json/?fields=query,countryCode,city,isp":{"type":"Url","value":"/json/?fields=query,countryCode,city,isp"}},"chains":[{"id":"1564381083594763587","root":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","edges":[{"edge_kind":"contacted_ip","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"Domain:kkeyyou.cc"},{"edge_kind":"contacted_url","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"Url:/json/?fields=query,countryCode,city,isp"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","edges":[{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:e429653caa5921a58f4d6810282f7a625575c56f67763220de93c7af55f89393"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:27ba9642cae974600f2906493d367fe022c7cc079d6772c0ebbc607bacc00de7"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":45,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["infostealer","evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6adfbd2e22d6183f7a0c91bc","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"WinGo.J.gen","contacted_countries":["USA"],"submit_name":"glaicer.exe","analysis_start_time":"2026-10-26T20:50:56+00:00","indicators_count":{"informative":212,"suspicious":57,"malicious":16},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"domain":"kkeyyou.cc","country":"-","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=query,countryCode,city,isp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}],"processes":[{"pid":7216,"ppid":0,"name":"glaicer.exe","command_line":"","sha256":"bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da","normalized_path":"C:\\glaicer.exe","uid":"00000000-00007216","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":3688,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00003688"},{"pid":4884,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM brave.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00004884"},{"pid":7972,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM msedge.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00007972"},{"pid":2656,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM opera.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00002656"},{"pid":6140,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM vivaldi.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00006140"},{"pid":4528,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM browser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00004528"},{"pid":1744,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM yandex.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00001744"},{"pid":3900,"ppid":7216,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00007216","uid":"00000000-00003900"},{"pid":5068,"ppid":7216,"name":"chrome.exe","command_line":"--no-startup-window --headless","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00007216","uid":"00000000-00005068"},{"pid":6248,"ppid":7216,"name":"msedge.exe","command_line":"--no-startup-window --headless","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007216","uid":"00000000-00006248"}],"all_imported_dlls":["KernelBase.dll","ucrtbase.dll","vcruntime140.dll","combase.dll","mpr.dll","clbcatq.dll","profapi.dll","user32.dll","rasadhlp.dll","version.dll","VxSSL64.dll","winmm.dll","nsi.dll","dpapi.dll","freebl3.dll","wbemsvc.dll","AcLayers.dll","oleaut32.dll","dnsapi.dll","apphelp.dll","ws2_32.dll","gdi32full.dll","cryptsp.dll","softokn3.dll","msedge_elf.dll","fltLib.dll","gdi32.dll","crypt32.dll","nss3.dll","ntdll.dll","netutils.dll","advapi32.dll","sechost.dll","wsock32.dll","rpcrt4.dll","win32u.dll","msvcp140.dll","imm32.dll","ole32.dll","bcryptprimitives.dll","winhttp.dll","kernel.appcore.dll","msvcrt.dll","sspicli.dll","WindowsCodecs.dll","dbghelp.dll","amsi.dll","MpOAV.dll","8Z0Lxx94.dll","shlwapi.dll","powrprof.dll","OnDemandConnRouteHelper.dll","fastprox.dll","userenv.dll","umpdc.dll","uxtheme.dll","GdiPlus.dll","bcrypt.dll","webio.dll","mswsock.dll","msctf.dll","framedynos.dll","srvcli.dll","chrome_elf.dll","msvcp_win.dll","cryptbase.dll","mozglue.dll","sxs.dll","kernel32.dll","vcruntime140_1.dll","winsta.dll","IPHLPAPI.DLL","winnsi.dll","FWPUCLNT.DLL","wbemprox.dll","wbemcomn.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"akg_4ee195_3.tmp","sha256":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee1a5_4.tmp","sha256":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee973_6.tmp","sha256":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_debug.txt","sha256":"e429653caa5921a58f4d6810282f7a625575c56f67763220de93c7af55f89393","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"test_output.zip","sha256":"27ba9642cae974600f2906493d367fe022c7cc079d6772c0ebbc607bacc00de7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7","sha256":"896cf14b9f17fb64a82c6d5070444b25e63b570f397bf8a96c9ba7d8d228f3c7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"akg_4ee1b4_5.tmp","sha256":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee983_7.tmp","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee992_8.tmp","sha256":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee9c1_9.tmp","sha256":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee9e0_a.tmp","sha256":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_ff_4eece4.tmp","sha256":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"~DF787d.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"akg_4ee185_1.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_debug.txt","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\~DF787d.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\~DF2c18.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\~DF3cb6.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\~DF709a.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee185_1.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee185_2.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee195_3.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee1a5_4.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee1b4_5.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee973_6.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee983_7.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee992_8.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee9c1_9.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_4ee9e0_a.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%TEMP%\\akg_ff_4eece4.tmp","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"%APPDATA%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"C:\\test_output.zip","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"pipe\\akg_dee3654b_1c30","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"path":"pipe\\akg_dee35ced_1c30","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\BaseNamedObjects\\40578b2b","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:7216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:7216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:3688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:3688:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:4884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:4884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:7972:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:2656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:6140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:6140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:4528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:1744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:1744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:5068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:5068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:6248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"Local\\SM0:6248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"SM0:6248:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adfbd2e22d6183f7a0c91bc"}]}]}},"report_ids":{"sandbox_job_ids":["6adfbd2e22d6183f7a0c91bc"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious WinGo/Kryptik.ABQ trojan Sample bc16bad32a7a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bc16bad32a7a…. Malware family: WinGo/Kryptik.ABQ trojan. Threat score 86/100. 2/28 AV engines flagged this file. 14 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da"}],["$","meta","4",{"property":"og:title","content":"Malicious WinGo/Kryptik.ABQ trojan Sample bc16bad32a7a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bc16bad32a7a…. Malware family: WinGo/Kryptik.ABQ trojan. Threat score 86/100. 2/28 AV engines flagged this file. 14 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious WinGo/Kryptik.ABQ trojan Sample bc16bad32a7a… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bc16bad32a7a…. Malware family: WinGo/Kryptik.ABQ trojan. Threat score 86/100. 2/28 AV engines flagged this file. 14 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L54","11",{}]]