26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample c5ec4c1fb44c… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample c5ec4c1fb44c…. Malware family: Win/malicious_confidence_60%. Threat score 85/100. 1/27 AV engines flagged this file. 17 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024"],"about":{"@type":"SoftwareApplication","name":"glaicer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":17,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9d4,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "glaicer.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "glaicer.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "glaicer.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "glaicer.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "glaicer.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")28:T64b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "glaicer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "glaicer.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTickCount64"; File: "glaicer.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "glaicer.exe") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "glaicer.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "GetTickCount64"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")29:Tb92,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")2a:T79e,"glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\92B46C76E13054E104F230517E6E504D43AB10B5") "glaicer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419")2b:T9db,"glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283481087 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283487730 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283740241 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283746387 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283936178 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2283942524 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2284618171 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2284626515 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2285622093 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2285628818 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2285839689 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2285846209 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2286358267 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2286364774 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288366827 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288374885 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288416396 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288425151 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288857353 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288864979 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288921767 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2288928481 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2290880390 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2290888561 [PID: 6116] "glaicer.exe" queried SystemProcessInformation at 00000000-00006116-00000C15-2291524559 [PID: 6116]2c:T8c75,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitSetEnvironmentVariableW0,0 0,1 1,1 1,2 2,0 2,2xml: unsupported type: expected element type <0123456789aAbBcCdDeEfF_device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimebytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed" (Indicator: "CertGetCertificateChain"; File: "glaicer.exe") Found api reference "channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: NtQueryInformationThreadgas warmup lit below cutgas warmup lit above cutconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value." (Indicator: "CertFreeCertificateChain"; File: "glaicer.exe"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWGetSidIdentifierAuthorityinconsistent poll.fdMutexGODEBUG: can not enable "reflect.Value.CanInterfaceinteger overflow on token GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandle using unaddressable valueunknown ABI parameter kind14551915228366851806" (Indicator: "CertFreeCertificateContext"; File: "glaicer.exe") Found api reference "64062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryRtlNtStatusToDosErrorNoTebAddVectoredExceptionHandlerxml: start tag with no namexml: opening charset %q: %winput does not match formatchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "glaicer.exe") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: httpservecontentkeepheadersoverflow on character value GetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextreflect.MakeSlice: len > cap" (Indicator: "CertCreateCertificateContext"; File: "glaicer.exe") Found api reference "s out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted stringmime: expected token after slashresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadRunebufio: tried to fill full bufferMapIter.Value called before Nextreflect.Value.Grow: negative len28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x" (Indicator: "CertAddCertificateContextToStore"; File: "glaicer.exe") Found api reference "s out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted stringmime: expected token after slashresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadRunebufio: tried to fill full bufferMapIter.Value called before Nextreflect.Value.Grow: negative len28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%x" (Indicator: "CertVerifyCertificateChainPolicy"; File: "glaicer.exe") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=RtlLookupFunctionEntryCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitSetEnvironmentVariableW0,0 0,1 1,1 1,2 2,0 2,2xml: unsupported type: expected element type <0123456789aAbBcCdDeEfF_device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimebytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of close" (Indicator: "CertGetCertificateChain"; File: "glaicer.exe") Found api reference "channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlock" missing CPU supportexit hook invoked panicpattern bits too long: NtQueryInformationThreadgas warmup lit below cutgas warmup lit above cutconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value" (Indicator: "CertFreeCertificateChain"; File: "glaicer.exe"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartunexpected key value typeExpandEnvironmentStringsWGetSidIdentifierAuthorityinconsistent poll.fdMutexGODEBUG: can not enable "reflect.Value.CanInterfaceinteger overflow on token GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandle using unaddressable valueunknown ABI parameter kind1455191522836685180" (Indicator: "CertFreeCertificateContext"; File: "glaicer.exe") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for abi.NewName: tag too long: httpservecontentkeepheadersoverflow on character value GetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextreflect.MakeSlice: len > ca" (Indicator: "CertCreateCertificateContext"; File: "glaicer.exe") Found api reference "s out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted stringmime: expected token after slashresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadRunebufio: tried to fill full bufferMapIter.Value called before Nextreflect.Value.Grow: negative len28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%" (Indicator: "CertAddCertificateContextToStore"; File: "glaicer.exe") Found api reference "s out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeunescaped < inside quoted stringmime: expected token after slashresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicybufio: invalid use of UnreadRunebufio: tried to fill full bufferMapIter.Value called before Nextreflect.Value.Grow: negative len28421709430404007434844970703125slice bounds out of range [::%x]slice bounds out of range [:%" (Indicator: "CertVerifyCertificateChainPolicy"; File: "glaicer.exe") Found api reference "runtime: sp=abi mismatchwrong timersOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmCreateActCtxWunknown type no name space closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by status= pluginpath= : unknown pc called from runtime: pid=RegDeleteKeyWRegEnumValueWGetTempPath2WModule32NextWRtlGetVersioncrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxunexpected EOF> closed by work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionSetTokenInformationMultiByteToWideCharfile already existsfile does not existfile already closedgotestjsonbuildtextmultipartmaxheadersinvalid mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!ruuuyksm3thrruuuyksme\p" - Source: "00000000-00006116.00000000.212194.9BFF0000.00000004.mdmp") Found URL "http://www.mozilla.com/en-us/blocklist/compile-time" - Source: "00000000-00006116.00000001.212788.26A27000.00000002.mdmp") Found URL "https://h;:u3h;/u'h" - Source: "00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found URL "http://getaddrinfofreeaddrinfo%08xaokigahara%s/handshakex-build-id:" - Source: "00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found URL "https://farenaw.cc/gate/chunkhttps://farenaw.cc/gate/chunkisallowedcert_os_1??\c:\users\xjw4kie\appdata\roaming\kotatogram" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://farenaw.cc/gate/handshakeuser-agentmicrosoft-cryptoapi/10.0microsoft-cryptoapi/10.00w=i" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=bczqyczpqhkjjxkbo7%2fqpsggjpbgmdzovrdm7gze1grqy3r%2fkcvjaw8fctnd11us2e0cgype84vyi3fh0x6%2fkphxq%2fuy6hty%2be4amn5jp%2b%2fukdi7mnfgo5ohecqj" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbm3lsskssm3xx6akqj" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbmlmemasycp@@,k" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbm" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0hconaddd" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl00.!z&r'hm0!gix-build913a231x-chunk:" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ktqkfjfjvbiuizwmmlzuntym3dkvmgvek6s0fuzmmyyws4nzzai6z8kds5j6fzufaacqygbxrhvsulwm%2b%2bip3mseudwfasvfzp%2f4d%2bvhthsp3yfeedhec6fjz1h1" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=a74%2fanggwtkw9%2bv%2f%2fpquqxscjqroso6tukxqbnwtuhbjaq6x3o9nouyz96uhaa9qzks98ivtuj8nemrl62r93fzja8p9dwkago8vgn1ad6k4kcftrbbn33thph0q" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=zeij4bzxyrdzenvnn1cba3cme7mpdqb3adjef1tlbjm%2fajclzext0oqjnycfef4vtmnhspa5qfqzh%2busd%2fwpvquv%2f9ko%2fm7r%2fposmut8alg%2bswhrq99zts3lw7vq" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=q9llxdsvw5ahttf0nzmpnjcuvk55qkzckgxojhgfp4ewrlih3lf8fspxnejpm1p0ftdx%2boxsxzqli09sstoe2hpheju9utkympv1%2bh8wirtdswngbzayxbtwuzvm" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris='fi" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "https://farenaw.cc/gate/completep(gi!5w,@(gisdcbcontent-typeapplication/octet-stream@(gip(gimicrosoft-cryptoapi/10.0@(gihttps://farenaw.cc/gate/chunk2.5.29.10xkc9washington1redmond1microsoft" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl0tpovbj*+" - Source: "00000000-00006116.00000001.212788.9BFF0000.00000004.mdmp")4d:T2c19,Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-HWID: 8913A231X-KEX: x25519Content-Length: 32Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/handshake HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-HWID: 8913A231X-KEX: x25519Content-Length: 32Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: sysinfoX-Chunk-Index: 0X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 3007Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: sysinfoX-Chunk-Index: 0X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 3007Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: sysinfoX-Chunk-Index: 0X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 3007Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: screenshotX-Chunk-Index: 1X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 37810Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: screenshotX-Chunk-Index: 1X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 37810Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: screenshotX-Chunk-Index: 1X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 37810Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: clipboardX-Chunk-Index: 2X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 187Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: clipboardX-Chunk-Index: 2X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 187Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: clipboardX-Chunk-Index: 2X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 187Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsersX-Chunk-Index: 3X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 4230Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsersX-Chunk-Index: 3X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 4230Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsersX-Chunk-Index: 3X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 4230Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: firefoxX-Chunk-Index: 4X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 337Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: firefoxX-Chunk-Index: 4X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 337Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: firefoxX-Chunk-Index: 4X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 337Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: filegraberX-Chunk-Index: 5X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 333Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: filegraberX-Chunk-Index: 5X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 333Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: filegraberX-Chunk-Index: 5X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 333Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 1657Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 1657Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/chunk HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Chunk: browsers_aggX-Chunk-Index: 6X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Total: 20X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 1657Host: farenaw.cc" Contains base62 string in header "3325c08bd40b9a1db7a6b9b868c0ce13X" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 8Host: farenaw.cc" Contains base62 string in header "f20c1f69da981133255e179c532b1180e" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 8Host: farenaw.cc" Contains base62 string in header "06346e998d5942a7b88bd16253a5963Co" in header "POST /gate/complete HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Microsoft-CryptoAPI/10.0X-Build-ID: 5e6f0b52X-HWID: 8913A231X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963Content-Length: 8Host: farenaw.cc"4e:T41f,Found registry query API: "RegOpenKey (in long string)" in file "glaicer.exe" Found registry query API: "RegEnumValue (in long string)" in file "glaicer.exe" Found registry query API: "RegQueryValue (in long string)" in file "glaicer.exe" Found registry query API: "syscall.RegOpenKeyEx" in file "glaicer.exe" Found registry query API: "syscall.RegQueryValueEx" in file "glaicer.exe" Found registry query API: "syscall.RegEnumKeyEx" in file "glaicer.exe" Found registry query API: "syscall.procRegEnumKeyExW" in file "glaicer.exe" Found registry query API: "syscall.procRegOpenKeyExW" in file "glaicer.exe" Found registry query API: "syscall.procRegQueryValueExW" in file "glaicer.exe" Found registry query API: "RegOpenKey (in long string)" in "00000000-00006116.00000000.212194.010E0000.00000002.mdmp" Found registry query API: "RegEnumValue (in long string)" in "00000000-00006116.00000000.212194.010E0000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00006116.00000000.212194.010E0000.00000002.mdmp"4f:T4dc,file/memory contains long string with (Indicator: "GetUserName"; File: "glaicer.exe") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "glaicer.exe") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "LookupAccountName"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")50:T40a,"glaicer.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\* (UID: 00000000-00006116) "glaicer.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006116) "glaicer.exe" called "FindNextFileA" with parameter Common Files (UID: 00000000-00006116) "glaicer.exe" called "FindNextFileA" with parameter desktop.ini (UID: 00000000-00006116) "glaicer.exe" called "FindNextFileA" with parameter Google (UID: 00000000-00006116) "glaicer.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\Application\* (UID: 00000000-00006116) "glaicer.exe" called "FindFirstFileA" with parameter %PROGRAMFILES%\Google\Chrome\Application\* (UID: 00000000-00006116) "glaicer.exe" called "FindNextFileA" with parameter 145.0.7632.75 (UID: 00000000-00006116) "glaicer.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Profile * (UID: 00000000-00006116) "glaicer.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Microsoft\Edge\User Data\Profile * (UID: 00000000-00006116)51:T42c,file/memory contains long string with (Indicator: "FindNextFile"; File: "glaicer.exe") file/memory contains long string with (Indicator: "FindFirstFile"; File: "glaicer.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")52:Td5a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Process32First"; File: "glaicer.exe") file/memory contains long string with (Indicator: "Module32First"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "glaicer.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "glaicer.exe") Found reference to API "ProcessList.txt" (Indicator: "ProcessList"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26594000.00000002.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.2A13B000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26594000.00000002.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.2A13B000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32Next"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "Module32First"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") Found reference to API ", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket Weight Share------ ------ -----Rounding drift %d" (Indicator: "GetCurrentProcess"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")53:Tb92,file/memory contains long string with (Indicator: "CopySid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "IsValidSid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "glaicer.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "glaicer.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "glaicer.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "glaicer.exe") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "glaicer.exe") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "glaicer.exe") file/memory contains long string with (Indicator: "CopySid"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "RevertToSelf"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateToken"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") Found reference to API ", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket Weight Share------ ------ -----Rounding drift %d" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")54:T62d,Found string "IfaceIndir" (Indicator: "iface"; File: "glaicer.exe") Found string "avguard.exe" (Indicator: "avguard"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "avgnt.exe" (Indicator: "avgnt"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "navapsvc.exe" (Indicator: "navapsvc"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "Norton" (Indicator: "norton"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "mcshield.exe" (Indicator: "mcshield"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "McAfee" (Indicator: "mcafee"; Source: "00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp") Found string "IfaceIndir" (Indicator: "iface"; Source: "00000000-00006116.00000000.212194.010E0000.00000002.mdmp")55:T9c0,"glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "glaicer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")56:Tf5dd,"POST /gate/handshake HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-HWID: 8913A231 X-KEX: x25519 Content-Length: 32 Host: farenaw.cc" with payload::==> "»dr®¿Hc7ÐEI/ñc÷Ð`'ù¯åmqñ£L" HTTP/1.1 200 OK Date: Thu 29 Oct 2026 23:27:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=19 cfOrigin;dur=325 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=agBPvyPF2P84lAA8JV57u1V4ZmR7XHpvGLfHMRY5rDuCnVuEPlK%2BgOrx%2FrG5mZ%2BMU1gdK9nTYHUrRg97MbU49aLhe56N3fZxB%2BzdYzC0ZVYCcs2WBIIUDfvnLa7t"}]} Server: cloudflare CF-RAY: a525f3ee5d4cbea9-ATL alt-svc: h3=":443"; ma=86400 with response body ==>4F4B3A31373933333136343637323238313436373030....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: sysinfo X-Chunk-Index: 0 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 3007 Host: farenaw.cc" with payload::==> "µrð¦Â~<ûRÒ4¨%?Rùp!¡LÌô-^«êµí·\!fmVÿ¦QÁ³Ö±.Ã®tð"Ì8¨î·£t{Óâ8z_²É)ãF½KâßîeuÏzkcîhÊr¸»pÛµÏ°G$²»¨*÷¦Uì*m=m²E>D£èªDò³¹db¡ £Îlèô¤&%L²Õ!é1ôÔûçþ¹SD:²¾¿²Á>¦¾ýö5`x¢X®î;CÿÄgÑübõÒ3(/FS¢Oº}àF9òAõ4±ÖÄ³'êÙo0%÷²þ¦orñIþ´þãvAhGë¤<§Õ£Âl2ì¢S©Ö¤6°_|Ê±|²HèùkËNëÒ¬ñ(YáæÙþá?X¸«Ê8ú;|ºCkñILî¡÷Ûg©áõ/¡²ö@Uq´!òùÆôïÊ=áË²zÒÄÇr«Ó°¶ÀàWîjÜ;2æO¬ø¥c±È_ÅÉZgz:Ú<ÑC>$^P{»íPå¢»KvÃrÁxIYLrï#T¥CPÁ¶mwõðÌ0@Úd;Xª[µºD¾¬ó<1~lórÞ¸eOO@»¹vcÖn ¼7d+n1Ea¬ä¡±GÃ0Ý51Bþðá´Ü/=é#z!½EcIP§?±Þm+ÿÓåîWÚètu8Ó²Ì%|ô]6â\©ç:´2é/Ðê½uìÈ J3ªEº¹£ö0ÞíDº·K¨Ï^IoE,O]SæGN\mpæô©E««[A°+3Qçnÿ s§âáØ#ªÖîÊØRw*`·ê¢BÄ¢² 1:5ÔõçÌ]]=¡íùu<ý÷6ýù6NÔbXWeÖ%EtïzH¼z±Ü~G²¢°§ ì_åiÎæ~»!pánjZö:Ôj´L·¤3Hòs×}ÃÃ<#©=&øöÀã`iÒ¬Ì³r³yØóÿ¤àY©@OS©µ6àøû#j 3×¬¶ô±ÓÏi¼k®EÁwó#ìºúLU¡U7)¼¤ßn¡;kñ¶F6ý$¬ø`sÚuH8èë]+ZGx¼ÑS`8(ñ|Ò%&§ßXDIM60¬t6µÞªDÝ»$¦q¨1+Ù¥Õ§¯ÅR5æàP²áA¿çIN· Ü³ê7Q]ö¸ÊÙ¹æ!»Ào^{âDÕÁÈ/Îe~?M»|T¢òý=[>EæIÖKËîiîNúáîCqÁ®XGÓHá}ã×aX¦ºq×´ø§¼¹r1$Ò5§%;3XkýünCüoG×[¢Ø5ÿ¦ýª~ ÆRU3PªúÏý 9YkìâÄÇÑÁjÖ`\h<8BÂmýQ(tø[LT¤ïäæeä(¶¨ìK$Òe#@d`gv(Å#Øõþ®q"bªÜy³zÂ.÷voÏ~¹iCãiñ/ôf]òüÞÍ¢ù&å§´ÄfÛáj«þ7îË×ª¯½úèbqKÎïÚ¨Â`6Zëu¿UhÊuq¾OÐè×rvä¾tPÊ2s( uÝÊ]\¢'¶?ÑÖ:)[ãÌ@2hÀïvu;{AÄ?Ç9ì±'ÁÕ¤NÒ+sfxÖ¸ox¢öÊW¡tñÊ·ª1S`G6v\Ïm¾¸¯,`éüõ5N)î¯ï$Í³äÙrÈ:T÷°·#~ñS©ud4ñvµºØiÿ"¥åFeN®r¬öà1i¦»¦¸ã.U#@\¿:9ÆuÔèòã[ñ{L³daÑ&|¬5ÕG÷ñvª-Ç,q³"\ñGéfêÄ"iTÃxaý%Yb=ðçY[ô};ÝþCÕP"Ýq`ÅÆoÂ7ZòæÌq.«¨«\U\Û©©@¶Êv ÞCãP/U;E'q¬$·¤9ÂîÍ:o7wasCÉúÓ7HU3ÄKêø/«¦ª®Ni=Éí{ÛAä>_MÀÆ½'Æª ¢ùÐo?Õ£W¨´{Fâ(Ëõ"Ø½[¥_!Å·)¿>èFµâ#jIÿµJÿþÛÓÉã.Ej@ÞX^·ÐËTQ÷íX]øSz8B|fNqNØ¾Ò¥½3¬`Ý³WªçgNynµàr2ËºÁot1ëÞ\@0#ç>-/BX8Jç¾D¨Ågôô¼)L6.Ê+éè¾úDaîÄ+]çËÓT}=X¤*ÁíîçÞg(t¡»·2ª;#úÊhNrrôÝzÅóé&PdÄuái~;L¡ ZÍ¢ñèçñiglvu!²ÏiÃûpÁ¢%ÔÇO3:××9þÈó,àQ;k<Ð+ÓÒÁrO}c¶9×8ïñ\ëTæ|-êJUÅ×3êk<Â¹oÞJºObÙ;¡"BüY£.HüDs`ñ~pjÝµTcßõ|÷6qÁj¥i~a:¨"&o.,Îµ[XêßG)kbªt¼îc»É[áw©½põºdQCÒ%ô£¬Cê4ÇTÀø«.Ó4Z¦Xú¿µÁJcþém`Ð¡¬oX¨kÁVvÄ½¸z:ëSYi/¾ÎXfmõûYUrF{E|VµWÄwöS=u:Øp§_Â§ïiN4[é$»n0s¨@å©tÞ¶ðÖõd³àµ¿e>å-ò9à:;"Hë«3h²kªÑE2"EÍó3¾ÅRå"*a?'óYHI/ÓÅé3Íþ¯ëáÆK!sKÅÝ¡>(uÿl¤õK©ùK¦_Oì½Ëvmz²[ýÒ¿e!2ò(=©A°ç'µmQÑz$j½våF`ÝÁQØ×Í ¸IÕÝ" HTTP/1.1 200 OK Date: Thu 29 Oct 2026 23:27:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=17 cfOrigin;dur=117 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1v6Ka8GzV5SheIMqRnsNB9LGpMrQAhgODOMohJE9FWfuK%2BgXRxJzu1QJMNGxlbbkx7SjvJHRfwKnD%2FgTWOJwraFeRwpaNcAW7NEzzF3PQv6E0c%2BrJqN4DrA%2FEo8b"}]} Server: cloudflare CF-RAY: a525f3f30b05bea9-ATL alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: screenshot X-Chunk-Index: 1 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 37810 Host: farenaw.cc" with payload::==> "_ÏÅ²©½r3»MB¦»A*A8ÿKúH§s£¨±´xEKô¹¨?»tÄ ~yôETjã>¶2ÞûÖætå£Á"F#È[×nÊ^¼ÏuA1{+ç9à«ü@#w°Ø'bù¿);Ht[0´.¸ÎóÒJÇ½ðÌ£iê±Ù~ï<ùÎvÂßrºÀ6`MKíñ}N_ôÅÝË¸~Ç4®Lãÿ;Í´Ë±pH7åª&_ Q4)¼JBûÁáñ/VÂ»]M¸Q×fö Î·'N({ôÁ¸ü^ÿl|¼nÞMÀ]E[kä2KÝzF¶øfjQéó¡8u|¯¼\hOsÍ¢ãõ~Ò)¯7ßKÜÊÈÖ#@=ÞÔ®Øåì]tª¡ïZC{EhÒy "ÐjÒ¦HQyÖIÖ(v·8M¢r#ñæÏ¼"»ònÎÍLõ-Q7êìúW`²uü_Ñ?d26ªê©sJÏâZaRT³ÅK«ák°¨L³ÀPÖ[Æ/ÀÒÒ7Ðïa®:"4Ö-¯¸GxM´y½þYÂòË:°z/KÎNØ}¸T¶ØÄÏÏ, ¶sStPU«Â©Jm3¼Ü'¨rë8ÞÉKÜüÍc.e*ÍÝ|JOrü0ZÎ×hk!&Ã4uÂM4ä`Hgßç1H4BåXtÎ½¾¾Ëg¯ÿõûð üTE5Ë;¦"z¸2äÔC4gÆeÄ6oÎùQ»x¢ÂÒïB¡ÃÁWn°eM_eø¡Åihb&âoNUêq[*Båý_+#L¬K}ÞAµd½GæR(Jc;dT«H>Ç×u¥¸ßhÝw¬ã[Uqù.îõz»ÿÃöþ%0Ê6Fd¯£i_î{`:Æ_7m¾Fº±}C=[RÏÝ J;r9+í³.F~ª¾xéï*ö(Ä¿CcO°æú³D6Ñó³zBë:(8xwÒG¨[ut¡mÎæda'ÔU6è¢æÂU@3q©¡þûÛ¢ÊmIpÁ0D °ÈÊj$(ÇÓQá]ÝX¤VÌ1õmâìNêìóÑ¡A.~¤m¹;]AD]í8b¨«ðL÷Å£ÑvÝ®Íª>ÉlùøxWÇÏ¨[=Ð´Ê¥FÜÎW=NM[àqe`0[pR«³ÁYÑÄ¾'Î{oôÆ¦²è%å©Xæµ#S:Gç+Òé¥Ïãw¨ãÏS8.Í cg'².Mmo(tÑ×wÏ^ÝYòûM0`3+u±iË¼ÁãÛO}ÿ²ÑÖ×ç¤r82îhaM±½¿ÃþeÈÖ)q¯+àÁ¤Ê§§lL÷¼h±¨> ûkÀB.\Ý¸NüõÓVôGRaÅwf=¶ î.ï^×øÖ+p~s?áîZå»c¤Oü¶Ò¶²1#\+)£¿}vy7á¼\:sÒ=0#1IQ÷0 º*ñ¸`ÀÌÅqMBAÏVWbº#Ð±j%9É k·=ÀÍÁò=[Ð+áÑg7écËp*~¶QÕ£.æIñ}Ã ;//zOÖOÍôã¨\1Î½¿ú:[Ìéåº'ÌvpCjÖtú£\}È?k8B§`Æ_Þo"{þNpÝI¤6ªG3W§a_ü²Â¢]ÇzR-©¬U·¶ÏOaÑß Ó_àpêLÁMmÛ\´rM¢þ¼)·ª]¬^ò_zÆKä¿ÃYèòÏaWT:ÝÓß%RõÚ'F¹Ú8)Ý«dø$ø¥}U\!öøÑuÉûiµâ÷¹¼¾;ý¤cÄÄ¯-å1 Â) (ßÿHõ¬á´ñc»¨§AQóy ±© Ùåì©HN_ùÃ.êÚ°xLXª9gK©úR¾/~àMi lÉeÚ÷êÑÃË!4à°´~çZî]Ì4×Æ>PêÐÿuNÑâ²½H¨ûÒ¿"!5Uv8ºOmF F~#¡ëÂ¤ô=QYùU¶X£M:?¤9ànã°tï<©v³ãÀD§:·@×º´yT!ÓÖ4Þdé¹¶Ñwé_mNÌrÊØ7ÝEduëNÎ¦Þ?0eghâa[%GUßª$â«\Ô?ÔC^¯@\O¢hrR|pa¢Áãuu{UVûÖSÔA}×±ÏÞÿ¦z/iU«ráâßJU6xÎ~¿!ÆÕïöõ"?òÝÑ{ÂùÔF<9BF@÷(À_¢rPÝ¯kç(ì]æ¼Õ??=W¶Åk`)uxô#Ìæýw¦úzy7.1¤5íõ*ÍµQ¬[ngÊ2ÜNA[#¼â`£ØsibÊaçF}ªð©ÅªvÄÂZÃ@ìDzW:+t¯ZÅð°åXs¢¿Äë#½Ò_FFnG?D°§`ÜNôCnÄÁ÷ïjùI¨;óF8!+hrený¯O9Ô1¾zÂüJS²&whbØàûÀ×Ñ¸ÍÁ®ºÿ÷èý¸ds6úá?h6L)YÁqÆÿVTo¹ÔG0oË«òÞíB¸êáN¢Ïuµº*êÌHþ¾sYi¹[´{ñÙË{Þû$XjÁ¾g^+î`I»ïýdyi6õÕ%®åb6¯1çK¾ßtAüJÊbÔò/2LLûìëu©¨éÒÒ!>ÿà=ÍUo24ÌRrð&ö#q§äÓY6_eÕ1CY^îÅÃÍäÕ´4"±.¨ù¤Lôù S]H«ñC¦j§²^&;êÏzl^XÊY:,m=krR¼¾ÿÍø^FD\1´¤hC$Txì±âOf½3à?0JLo¿¦+Í»®ôuXt'Q:kÖÓþK¤YÉ(È&îÏ>Û²NVøÖàkCuxÐ8 ÏCQnÈèA»$}Ä¯ÏAQ÷Z4Zº9«Ì£B×3:¬4ù¡æ÷Æoÿ5~b;ü¹éS7å6cÍÄè¹ÑXÁ£×^§n7qûõ©VÒx¸â1í8àÐö§SþôX÷ù"Ïõ ø=xÀëó['÷¥(k ÎH°²jÄ}|äÁpýpJ¦Ulö'»:Ò7-¬ "Úæñ£HPê_¹é`M_.jßõwÀP^¾ªPÆ 8Ô}(¤6iGV+hDÈWÄÛÒ3ê^7¢p¿Ü^&=âwÕº34IFºþI«Ré÷ú}1)¨ñSÆdÙDiÃ¥µè¥ÿB½Û^^3èªfÐnëJ{CÛ.VÏsÞuÇÚì]ETtàòñ~ñÊ+º»É`¥ý£+S:s.înbEÙ2.ÁãS¤æ´@1õDÆäâøR±@XñEÖê1t$nÏÄzyY|5YÜÂ0jyÛ_{Þa¤TÞ(ãXÃ6-R°9|¿ª©Ua$ðqqP±Pú¸câ[É}8uµý%®ÿiÏNÃïA¼¬éðG`¿N0Óõ=#ìÊY^7K1¯£¾Xä6[ÁVjÉÅH%Ø¾¾évôVºî¿5¸ZÞÏIäÝR°¼|:'ø-èb®ß>±@7PÈu|ÍüXYv¢ÖNÂÏêû²V5¡Ä½uÃYý-w-âÐúoÏrDºo0ï3@'oQ\Bµx8b*»¡}:êÒ_ýÂÜÚ°ÑÛq;A`$íº\[-çù5Ë9ÌÍÊié¯võ@:§/4ë¶¯ÖCÇ|¼^þCo¡+1Ò^WæZ¨ÜûbQÔM!cEYXs)á=è¶¸y~æufZñÜßÚÉBsÔz1súãµ®û°½!L?2g¼¨ÄTÚÅö®»ÙÆ¼d½l.ÅX}½átzÞ¹ÞûjL'Â%'Òÿ¼Ê?\AäBCS}nj»+ãÇ¨USZÀØDõ1Ä1Sfx6'kgFT¸Û+%%(BT?@ç}/¼ö¼/ôÍLÉ|Eâä¿)ø_ðËÛ»M¨iiW0üeøÆ?W$`}êÕL÷Üç8Ìw:E'!wÒÕÚNÊ%^º×Õd\ø*«¨uî$w_ÇªcñH0s/Ú_ÌM©Y©O í¨Ü!Õè²R¥kÁËÐ¦Fÿ£ËxûtA¤©AåróÅÇ±ðÕOôgöî7ôh¸Ñ,OË-¤&5nzÆq·T¶¾¤.¬ü¸9&#(f@´+iVfÇò·ú¨/ðQjcc/NÓÐ4@ÔÑÉ;ßÆ¬9À¼8ÈUNaæåªÈ~Wwô]ðEkº¬\ ª|9Á&¬LtÇ<¾vïîúOPnMz¡Gm¥XAøàëpÿÃ$*øÑ¿ïJàË?"FÎÊ""Ë¬[a3w;Lòc±+nrAÌf#X¦÷®~¢kI£é7¢O"¯D;¤uÒ@»uÚE5*BmÝV|çm«\;}ð©{ì#i8Ë}N%N¢§¢YÇ0åN|6²EØ¦ãß¼:RÞP¨µô+ÙÔàòý$Ó¢/©P-XRKñO>eu½¡Õä®!{éGbmÅÀoHÉÜ´PÇr[ôÒä³¤?wJ{ (_tÕ®í9µ90¼¼¿·SnSúJgqL1&²»|/øZYÄÏE<Íáã8Î+ÝÎ§$ZäÅ de_¿VnÐóÒXBÞjâ´~"ÀeGägÌa«l|Ö°$~¬y·Ç]/å¹Z¢ÍÔXéùè`B«4ÑÝÕì)öÜ`7·8#VÅÿO{N1KéÌö~bED³ªu×ñtwEôd`FEZEÀºWØ/JÌ¬8yñ®v1i²6(¹ñ§o§°ÙÀF^wC05°íL7Ê!Ò'×ïýÉÝÎ:e¼"«ßYþV¶bðö¥õZg#Wr¨ª1cÈèfxé-Ö×ÙºÍD¿$¼b»(®ÝwT½¥y¹qnÝ¨uæþ|î¶o#Zhòéx j¶IéçÏÄÙ^xË üøVeXôN$o³¾È1µÂ¡[x\¦â´G? ßk'^»cÜãèÆÑkFbr´5ø¢dI`83XGJøÍ¬ëÃ)kxHW¬Ñ2UÕòoÔó~×Tf¥ÅtõLÆZ0!?yxc! e;¯#ÞÕFêàÂëí¾ÌÉx¾Ëm{¾|p´Þb0F&¬Z³Âî½H«q¨·ZãöÆ]@í¯¬Ñµgf³^àïÞ¦àÌ61zßv¼/ñ)ËIn* ZýýÿDô½TÎÐNÂ¡3FæaäÄ·´H_aÊñ*úBpÈ %·wAß¤°9ã½þòÎË!¾ ]KïËdæ ÇW`y£ËQÕ¿órn¦ác±ê Põâ÷Ñâom¶¤¦ÅÔ¶³/íüç&.7ºÀeÜÚ6/êîcz.Z?zCÆì-ÀP»\Èìp×e©µæ¼eiÓ±ÊZójþí£9Îy1Q¨È[ AÀÝÈßN{Cjã¡^}OÉ'Q@7³^Z¿*(lÔG×ÀÏl3Þ(ìh(pÛvP&_/KM,ÔÇsÕ¤Ú°ÏãÕ¼r"úð±ÓÞ&í6'¶¬T-ÇKû?¦tÞG(õØªàé¥ªvÕcÜQ4ì /[ÿÛBÐ¼{<Ö²ààc9GÚß¯_;©ITN< ÿK3üuR´5¬7|®,sbïi{ÒJf& <âÅ0U"|Ù+Ü?Öªá{.à^ð£!cá5ÞÝ¥µ²AâºAÄÄ6ÔFÂãYË¦x'>ksDg>ôVfï#Ê"^¯ó±ýylÜX5î%¥uö³é\¸ÓQcöÄAt÷Ò}M¶¦*è`,+SjÉîîÖW·FåµBítPS|98¿ßp-PÈÜ=9÷bª¡4íw´¶çkdj/¨7èÊÏìGÖ·e;Öõª]\=e0±©W*,X¸<7)%Þ½íüïÐÓúÿUÄ´ò¾Ó\û*ÆG¯§åNÆûnPÉè¶è9üþ«î<ßÇ·#ÃagxÀÒ Ó9ErÜ#æ<ÃA`bhðêæ¼ØqÝïµD6í(ÆßC+û·ÂMû5òR¡§_'/²ñU£#þX²[9%ãïêÕie"^UkÅcÖdZêæöm°HCÙ,2`]:oS¯C¥¥¶°g)@²ëßNt+åëÂë·%²püÊEúÔ×M2 ÈÝ>Üÿ=cêdªv! ÿ÷àìPàá$Rì¿n½éûrTu®¿½wrkWëDgÞÚ]`§uµozZñIT¼ÅÜ.n«#ÚÐ=Qy²ÈQ_ F9Q-æ!KÜ Q#£½!éÒY©À4m«³¸5ÙÒ4Ç®v<¶ÄîìÑN°âé[f¡8ÞD4ãB)÷ãñÑîEõx$bJúõa¢&à$ýöÔ K-ìÚ¶å¶¦7°7ÓäëP¼þå4414F2£¼;Ç»=Û#SyÜpGà6ÀeBÓwíhåÐ¦ÕXº¡G©ã0ÊM¾plòÖÐ(3ùÉõð8Æû$o7NGAË-Þ$½ü@úÛ¦KÕ«>vl¤3ÅDn¾jìÎ7GAêð¯äGåKD/Ï}Ý¢unÆß£8øÒ·nfsêè¨ ¿¼+0#OkvÓdpø)øêctïkøbGñÿ{ä.=³OØ<¹ÿÂóÃ@'xðF?.Í'þpb?P§Å0»èÔ¤FC6wñ½é$¿f¨¥Üy}Û±äSèBÛÝ(4ÙâÍv¸ÐûìmWø!Ø½÷.ì7#>h=«G¤çì·´Nêôï=ÜæéÛS¬±²êT@«8¡Æ<:rïmh 5½5ÆGt1X×ïSñ½î5¥BµNìi!QX±ö×ÐÍ¥JªßÛPòQ6>²ÔCù¨Ôm¿Û®¦µ&÷VÚèPéÎ|B<í¤ÐÚtB(=ÉèÍS_LÂZÇ$¾ä0ð¼*Uå5î³Üt¡ä}KçÂ¹Ý^qHWéd¨¡M-ÜãE¼L¿PPklÏØý·ú¢u@[{ó&EÃG8Ñ-dkÁ½úÛµ+_7þ¡Å½2/òÿàd÷ 3.c',é×|(mÁX;û©W¶íçÖ½iÿ°.áWí±×UÚ{ãÉ¤QtkU"1WõÈCéMw·T4AsLÌI÷Z`ùÄ2,Á¡V¥Á}n×Ë¤ëÔPS,Ä·ê¦Ç$Z©ÓK%ã Az÷ÎÞe,È7Ó<¸ êÄÅôÆz³¹~$u?EÝ_§+nÞF}¹õIÐMÉ39Y+ÞLÄ×{ .ÖÝC oNØîòd-³~E}>ç]q¼Ò I@èæ~'Û{u¿oÁÈPaù!u,¸¶\ÏØ'ÀéMMFÒ<_Eù^6$ËÐíC4E§q³ÖÒ¥ÎÑø~ñõ «JÃÙTTÈ%âE3ÝÑcè;ÎAÐÕP_2L¹ýS&¶öô±ï üëjÕãÉmøÜ¼üôx åþ¯¶ÿq +(ïVAwÝ°5},,úÕDÍª¹sî@$¿ÉÆ=87!LQò÷Ê+Ë Rïa9ÚÞH·ûñV yÃ°JSgø.Õ÷}oªèaÉµa*Èr[$ºCdsJìbN¥v v¾ØÏí/iø'÷Öï¬jÄà¾Ýz=¨¸-±V¹.FÕ2ÛR`zäGòä¨Ï*iÅnËvu¹0-\¦Oüìu<:PÜ¦ØÙPçæÁêgoè÷;]Âj`[úm$WØl-UJH] q ³åY|Ëú·Õ®EÔª0ÙÙÅJ^ùÔ#Ûó0¡»jÉæ|ÝDÓ_Äùú«ÞÝdi¢~Îo?ãd%`ù{ß{§·Â3!®}/©Ìþ,¾(ôÈÍã?sÐF-øn_ec©ëësäí1s¼ë¿Þ49%/ý½ò°ÖÿqvÂËÙyÁOÆaªûGþ[\Ã Ü;T¹d°«´o=«+áÒëªüIKÜfâÃPrßfpäµ¡tË»ÔaeD´BÊbô:ßÑéâ_È¯¾jåzuÂâÂ{g¼ÔQ45/5>Íq÷Ù ^àÑPÝô_ä÷ø=Zø¨9b¦ôóÏôrÙnæl9yÛS¸6nJéôË$dæeg»AIëVNö42ìcgCØ$Ãcñâ²×1¡'ðå$Û~Î%;(O67âÍ2k×ßfvøúEñßÿëºrý¼ù?]Þ0uûÔnC[á3ùX{jâØ$*> ®5ñæ½*Üv8°èts ®°æ¡Gõý°¥²nL;Ë½}qMík/×F9møHø÷7LWª*ô)Îö6|ÕÔõ¹!£5bñáhçº»¢iª?©KD®Jâ1<îàßì8tà¶Ì »ì¢°ö/N-%½¡úÒr6ùäqsø4êð±èV¦qO/È>¿ß+÷ÿtzL%ì#ä¡ð¢Ñàóá©ª¬ÒYW:Ú:¿cdQïc%=<¦ZØ$¬#/#ûÿ}×xÏO0E¤c³Â¯'~zZ4èz·ERá11³]µâ±ý*bÜâdÛHò£'¢å·W¿ªFÙ|éÓ<¹v««ê¡÷²y$7´Ô2Ôã)íÂ£yiÛåÚ7Î°Vúù?G¦Ëb6¬÷-ßÕob¡8 æ0|lg?7QºÏ÷bQêmD&Ö¸ÖëÔ=#tÙh1ÅQ¯åØM?½®Äe2xT¥ö/z}<¡ï¶Ï@ÿiÁ¨ÂJÎ± R>eÈø}xV»ÆY1\ÑÅ!ÇÙÉ]-±úÃ~ÇÍÒNíçå}aO%ùÅ¾îÊË¢Ìs´8Ð%çQ X©j1^Kl:D©"ÿ&(ôÖÓ¨ÇóUÜ©«ÞÝâ ×#Þ¢@vvÄ) Ýø¢¾ù¯Å¿¼!ÅP]aÆÍÊS$.0#Îë¼0 Ü´2±Ú¿Bî\ ÿèleMrycç*9ö«×U&SÀz^Þw`w¨ýØ2ÞÀ90Há ¢EXeµ{K´àÄþQ`Q³>g¥~èßê¬ïýøÎ¹®7Ê ¦ZZ We@XÀÇ4HÉ®AïÎDZC£MßcgøhÚsEéÛÏ`¾XÓ÷ÎJ*ßjûèDÖR°¤lKËÚsÝe4ÿ9¯úÅ9¢»ôR¿ÙBÊ¬úiO¬iå^u¯L»#-N¬½jV¿aM½#%[øäUÙûz1áéh p³vR©ée#p"Ã¾åÃ¶ìK6«DbCaÑûR5Ð±°=ÜÒ1HýWÂ!ôÎZÛD°/qü[d¬¥ÓÃÃíË#=å¿ùDQ×ÿOÄWa`)âO2õ®qÛå4dÄá°Ê9Ãß$/u¬³#¢Ù^Ð>*ìã0ûÍ2¶ë5<)¸Þ×b¿¢\©$[©ÌmHH{×O·õ,PÎ1ÿ8oDQg´¸#£ÖC½98ÕþìHQÿäc¡¦¬a8ðTeíÞ^ØÉk|¦4IÛ,ò¬d^©'~¦%m"Ñÿ÷Q^·ííèP$ÄhèiSzFÙ-rVèMíhï?|Wÿ3P©Î¢¸çÙñÚ¶|7±\Â=éaf÷Ô²uå9vö`RFÐS¢¢PîNipúuUEuÊÜ¸*mSdÿ¿¸¤¸)¹§téN½UZXa)®TêòºaÌÝÅ=}dä#xi «ZJ8Á´ðzTÛ÷0õÄP_¸ºe¦¼Ñ¿øä'~§K¦ÛÉNÁî4XMtnJR¾îöî:ïÎµêÆ=Åïß·7##åÁÓW¶ÚÀ\MXäL`n$âÇÙÍl\ý¹&(BªÑV©%ê´o×ÿôÅØúH±ÇÏÞuùÉÏñ+"Ç6æÏ/QX*xEùvXT7rÑxLÅ4ÌCoÚ]7DF-Gqþö6+7ÕÆ9aù4ÇæøK`m¦æÿÉ8ì"Ã¬Ë3'üû¨¤À¢þb8[çLÎxÆuK(ù¥>Q0ÒCW#Éb<1+n³äA CÆwLïLÁ¥[v]ã"Âsä;ÒFk¾¿ß[ò|g§Q³|ñwÚcØ5ç[Æ|RK^µ,¤ßÜ%2&a/%Æ *g_A}èøÝHàÏO\dJ7é¯â%{¿]ÉJtîøè]K§1ê¡wÒÉ$÷Uðý'ÍOwvµ¨q+ÈÃ ª#¦ =*ú6X´U÷¬³y89óQqf^.¬§+aÚvÆ@úÛ'û;:¶¬MÚ×ÏL³ãÛ~ié¦&ï$LJßÌ9yÃ¡QÊ|K¨îþ©:yéÆdÅÚÏ.x;l×ÏâRÊ)ä½Pk"äï&£ÔÄ¤ñÔ¾xvN{êß¦ñò#øÈ'TÿAaNäKí\ x^B· g´~¸ýgnyz)lãkiÚåyÂð'1èúÌUð.\ÎðN5'hÛ²ùFªýO¸þçÛ{SCÌÍ¬!¨&faqda»®òNºËÓð¦3^eà÷×ÑþÕÖaZsba#òi}@C$_%\þ»Z9£®Â¨_ì ¥wõã¥ÍZ-ðVáêÇ¹òl2sëÐ´$Zy¥ð!ò[l7ýôt/IbÿÈd9¶{×VG÷&ú;õÙqb`Bg»ôC¨ÖKJ5§ÖëùOêàAuOÇáà²Þ8mk8ì!á·%W-+Ï`zÍÿà_X|Ø>gíÅLÅÙ'Éh{N*o.PÉh6ª÷º0]GÄ¦ãÅ´ÈJ¡>ÿÄÚE©OÈ$¼çr´ô&É %zEÛMé|®Yi*:TfNNÉhq½"Mù®ÄS¨}OÓÚîä0kþìÖ-£+Zim×ÅàGhÈR®'O'úÝ¹©Íá äQÙëh ISÒ»DJý¤ïxùZªåä¬KÅYGdÓ×oÊóZ-?¢Oî¡áB¤öèxKî1hîP´É\¤s ß¿ÕÌí¯ÑnT&·´¨X·-¡¦Ì"Ô^L°ä>cÞþÿÝLE{¸¿ÎPÜÐ&aóqÊXïá°à®ìâ6vºf{ru¥^H°Ö<6´jìÓr[>æÀ{¦Mtî÷¸xFÁ÷Ö®ÆnuªÚvÀ EkYqjË«ÙR½çþ;Dp¯æò¦:fDL¬I¹©&IN1¯øOð+UÙQ³U=¡f×I¸a Z5;[uIÓR·3hSrþY¬cO°×ÒéÐB*ZWww*%ßÔÿZÌfêBÎ}r:C[Åò.&ñÍáÑ1£PVóí à@çZíE³lÄ¥ËÒûòP^+(1&É>:ðÍ»5~Ò¶Ð¢N9InFê·Nàì[î1GWÿß¡ï|%Â»Ö¯TT`Qç+´E?Y¥T|Øâ=J[Û-}|9à©ëH¾|T:Çß3/ñQbýÑ¢oò:í®)Bñ3BT.æ6±1YýÉs!ß¦>¦Gæáõ2£J]CzÉD¯N&Ù6Q591ª.ñDû¨[Yì¨Íiû¡·t=m]¤BpÕ18}µÁzèì¸x¤%ºk¯ËþÏ£?-éõàÞ*e(Àéi±a>ÊÃ`BO99ìD+9e..#ÂÔþâ[%âyv¯èb'°©®«ÅµË*ZùùÛLqÙÿaQ=jgnv¨½lñ½é_¯Fs/ÿÌ\A¦áØrì½ãµ²«ËZM_º7:}¹rCl×êûA¦A]ì $î[=g²Uf}ª½È7.#¶øOðÝ÷>öàAÈügrãGvÂÃØñácYx6¹ì6nÉVË²mEÇMæ4ZÄvEÕ#ZaxmEr"+`Ôµ"Ï°\Äw)@ÙÛSÔÚPç%d5·¹ºS{¯ì®U2bmYµ°Å£1è\CºÔx"$úLÇkÊÐÿÎ¸zÝ¤E¯MÁ^¶-î¼ÎÜ ÉgqÂHÐjÙÒ¨4Þ¡")ôJPú±®|µÅk&ÈÈ»~ÆÛB8ifywÙw×+ëZæ®©Ùy:ÀuXæ\§ykF1Eï°Ù¦ ÁJ(ÙMª *µå^¡pø)ëÕyk¢ü¸©1Í?Jbóa·ó3e¥4ù5*ã|òzïÕ1 3¸{ëmÞO¹) s7¿Ár^zÓony_Ö<ø¸ü8*o½CZ5¼-WÞëEúlq'jXcÆQ²>·ñ"TAxÉdÎëyl3LL3èÙR&¡<é$~]´ûÑI(Þ¥'pß*z· ]éT³æi^Øv`p\¶EçË9éÞ~¿m·HÔ Âê-qK¿Bå8Ä'lPÂÚÁÓ-s\³ÞKi¥c;0-Ó§Ñ)êTïöÄo¤}ÖÎIó`sr:Ñ©í0¹HºSâ`P:Q9%F[¿ª/±Òë¬c+Tþ=Îð*Ïn3WW3ú\¹0ÖK¼Ð=vUÂÛcÒ¶à·: n:Áv<ùçÏ_erØ-5ßo<6|p:$}wÓn¯@éL)Ri|ýCÁqÐ}AÄÛõ¼«ûÊÍ1ðºþ¸¼tç÷T@}ûjævb\ö³ý÷YkÉ"CôÕ|9[SºE+Ãeªy42¦;ÚÖÈ\¾öcPû(-å6Òàq =L¬_!·"ÌJùö:'b¿NQÒY4¿·=^üÏ!1úÊ[ÿ=Iã[*SoöÜsl¼ÞÆ»;ò'ÀVo¦2Ù}¾ÑÈe$ÛáëO¡GñUi3ð©áYEão½k'Ñ hl2îç@eü.ØwÜá/&QkknX2÷þcúe>ÙqmdgJ\R>FAÎìyBÅ¾×ïûïâªn-³ï%ßÅP\°yiKc~8À7-1¡Å ó³ºý]mÓA.5º6ö'BVÒê£gFÒÒ&}"Â«(dÕt¨ùodü!à½<[ë )BÂoÄÏ²Õ×1Q¡@}VZd¡CQ×ujÉYîk½8%q¾}æa«ÏÊl´P!FùCçôlCÙzW£þæ,oGÆÅ~ÌéRíÆw)y¦FÒ¡RDºTòûÝgßluqqÒÚÐ£Â>Hb-4Ã¡¾,ÊàîÚöMg5gÉHZà¤z¾e,ÖfÞnÜp@¯rmÈ´ÇÁ:à¡¸¿ØºÉ°4@J{þË?î¨"ègãÙNùoQ¥ãõn;íB3ÒIÊÔÁÈ9Æ +D5Î æÞXæu,Áô7nC%°¿b7Ñn+æjÇ;ÞÇ|Öc^~ç7v¯û$o«v3yËE%<:'kG»j¸þ({ËÇ9ºc~THq8Ã|m¡0!f¤wàÍänBjÝãe_¹øL[(ÆEÉzËnºhÁÚÈã0%KþõîÚ+ß9Ü®çs#N_PTgcgÄU¬+ù}':áØ,åØÇ{«³11òZªú#iqñ·â²¾ KÙwlN«='ð±(ð7rßL~¼ã¡5ÁSÈw0Ù"wîhÇ¢Ïù65/Ìä¾|Æ¼E¹Ñ»)r <\ôñËïþ÷$Å¹¼_Òô¦7¨m4ËEü ì?N¸è{K´?©äÊ!J¹W?IrO²ô©JOn6T§pÏ{Åp'df)¶7!°2¢Æ¶ºO°r!C_I@[ÖÞ®*SåCç}ôD´ÀÏGl·5õ×"Ô~u¾ã-}U½í±ªjPäÆ«`ÌHkwÚ%é$~<ýRÝZt=?RfÏÈõS9ÇAö(Í.õy}oñ¬S¨Ñã¾w|°3I×ÃEÇuLVHôô.`6k0:Gpª)a¼¤TÒÒLÃ´± Íj÷LPeÿ¨Ûl¾ÒøXnGÓÏ{GæÌ¶Iy¶:@ÙÕó·³ïh$/bqråÑH×»on-¢5÷¨ò.Z'w°zWSA$nzÌÕ¨a©ÂÉV^7Ó«_ÑSl¡Æ]é¬ÇÛÊkë©KAu(¾jè´¾-¤´ÄA>õaiB~J~yw²ÄPÁÝâ\¶¥6ÛøÿèB£<;f{Ú"õ¨·¸xê/ûL ïÑoxÅdÐÁ%î!Ø6Oö½f3À õÿ<ØðÑÇ1~<ÔöþÉ¹I)O7åa]A2^r½9óßÜHfgxO{VI>õàªzÎÅÍþ¿wlt¤`?¬[Ç¡¸×{ÒýÎ6ç®qzBwp¸é¿_ÕT´1°ºK;_¸þTö984D¢0 æo5dµ#%}v8bï¦æÅÃ~ûå¢Îóx¹KzüÍÄniÃ'Ø0|ÐåÓÂ%<ÉAHR¾½+YùXh3!)À7?WM=.cm«ë^Á¤ÅõÆç½ò ä>³z1=[&# âq²Î66±ºY%¼»å´òÄX[ëegzjH¶ms·JÍÍ¸ë.ï²ql@*l\TïíY*QCgíxãy§u!Á@ÿÇÑëÔ{n5W\~;x"k)®Ôú°ÄSÈÉÛ £V¸,J!Óªö÷%ZéK{Ïô¥ýRMAC¨;Q×m¯B#*ÝæsÔÑÛ~kÒÉýt_v{í¥û$ó2ì1}-á-®øV!³QNmÌ/Îe)m4ñÜÍ7åÔuz^Ý¸Ø>=Cxy:È¼ÃåÕr)4Q?FÔÕs-ØPßõ0\üH¢´Æ¼t{<²®ô×<ºSH´ÃuvÜ,×#2Ú=¡Ý0m½¼ü±ú?òøkÎùóy Ûùn0Ùþ3YáckrÃw%lö¾xÂüà½ÜU;»'Ò¾íÏ¯Ü(¢¡p¯ÿ´FEbTÊã¸õ×Mm¢!fNOéRYÚ(ÿ×ßpo-|~6®ÞQ+8R:«±'d>°auEø´éÜ)'cúáj½ò{¸û!ø½ç7ä1L¿u»-ÛKë¡Ïúfa}êB'YUj½ÛfÙIeOõTéÚó°ØàJ-xP\¤Ä¢yÀò¢Ñ¤³6ê;cüïå WYãYê'Ûb4:7®Ý$ýÇÃì¾*²TVÉ,çaWj½,tf!Ð±Ó-Åóì|E?¹åaÖÏslZqß}/;õn·Ý Á¶ÈdÐ¬>7;×Ô²¨ö%}ÏïàÌH»t½:$ø+ yVïn3ÍÊÿëJ\þ{¯~Ým*°ó\»ÿÄ8Zò²ÞöïÁÓO»n¤y'¯ë!TÞÆ{g#ðB¿½*©&&ðÈ¢¦ë~^ ¦2²zodU½^1 Úäq¹P©Ó÷y½=ãÉ3¸û>"ò±ºÙÁäÆÐp´(6û>´ÅVo]VòíXðýÕX{È$ö8}]Ã÷ûyå`var¨µwmÑ¼"Æáàm®sáÆÝqo;Vµ¡ðmÉ¸S[¢7Û}t½Àþ9k.B¶ÊÍw=-Òî"o¿é3æ0ÖÖVt/ÐûHåMM£È! WgÜûn¶B£êL£Ç·é÷vSÿißHzæt«ÈZtÝÒÙWÄ¾øÿ¼·õ*3ùÌ3¤á%½Â^×èÚ·æýÜOì?ðùiÍAú²qG¬9NèãþµÛ§EiæÌ9µTÌ¿¦Â"¬=Ç[*däèp{Èï6~Áy¯ü¤âÊZªy$ÎRÙ7ÔîøöÒ%;-ßy~ø1ÌLaG7¡µLIUÈß©6rñî5¯ï)S¢pRlÝüú®CP¯¸u§/³:!þXY½æ\èäßð¤®_/nsq>¤¯·7# ÉÙ*àõyÍá¥óçD"n§ëÒÛ~èâ¦(µÌªU2M&ÞÝíØü¾/¬ÑÉ¹èDrkx4²ä)e>Q:éL¬øÞ´ksB@ñÝ?{§L£zé÷Ò¡H=Ma `¤£ÈûdàÌÒyqüx±6ÆãÑÇx¶æ$Þaà\üÓPÃ"ÛPdn(F«É7C{#5:øVúü_Ïf<ë~!èÒ»%TIÝâ³¯ªÃ·.w*¦iÊ`Üà¡B]N26&SVå1¨Ï÷¤o;*hÁEJI}ïÎq^&·Cw¥tXAÖ5hÍ`%Ñ2(æÑ|Üeõï©uxùic+æÂá3öG4!ßËäXP7ÜçºÅu!ÞÇÖßW#Ð¥Û/2à}ûfÛ?z×¹ø¬¾|õg¡Úk¯J¡0ÁK¼ÊU´¹PyªÌÇå|£EL=Ñ=QIQÖDguø*e¨Â1r©R*ÿXÌ¸Q~K5¹:xØ^CÆ`cUÎ9t| ç$å3Ï×+tñ(¤BA.í>ÀÉQªS4Ñø@Èr?÷lÔr;eþ(9öTdE«ÃBºÚ2^ôq9»zôR\íiEDª[ÖüLC¿á¿áZA;h#{zay\:cb§þKIî!!ÇÝé:RzÄ7ãPâ¸x¶`CNJ´ë·Ià¸Øîh³À<¸AE¾}®ÏïËsüoñÄÌeÂÂûm,@I÷¾æ§¤ÒÊJÞª»u[-ÐOFÑ?@SÕ%/+Ì6 ÕsAÔAõ5CÓÑê½D¹Á%AÊn@`ê¾×OcWàÂqAËì%®AØFDD½ÿÖf#Be§¨ú}È J÷<ä¯6%>YiDÁËÎHÖøèn8\à?®°Å¸wÚo®¢å¸ümC{gù{,6ªÆëþöÜõ·ßr{x#[#ôòBCÍúmú´wnB¦ëCÆ¹+´%7y8=¤øx&[+8éË¹!ÛÈ:Å6@ÖmeÅÒªÖÀuìñyP¾:QèØ1wnùG¹B¨[©$4}E\O%ª ¬ÂÅ7c$°,>RâcoKZ:Îì¸[ªÉÜÒÕíNæqt³>Ë¶³H]Oâ,8¤¡ÈÎªà/K·Ô57{jì~ã¶¡ªÀÉ]vªQ¿géÅl;ZPòù!ÍÙU6EoÃ~â¦Ü »Xõ¶?ã¹Aoàkð·:^å§J6È«ÿ,ñcÅ×HDø¸úß@¹#C^#=DTN!á®ëÆÄnmZþìaµ¸^-[6ÛÕYÃ×£+q¶ô-ü)·*ß/xù´ÕÀM¾Eõ+ðU4tÍ&VÀ»]¬P²¢7Kª4ÞviöJÏ/N]Ü-oª)ggQÁòEAâ|úqéÅ]Í7©[½zÈsÉßß$û~A¡ýDÄZÅ¢h#W"¯ üÿµðó¿À-ÏÌÊdY¸~¤rÊ_özsP¥6y¾Ð°ÜáÊªAHµÂ§ÅQ£ÍÄÂVgoÊÒ÷ÆÕÃ'¥?QüJYÔ¾Ñ÷¬ªùÎ<üô_½ÑÖ#é%¤M_¦NÓBÏË«djÀ¡dÇ]qÂ¶Å\f'2¿ÀëU~t*1yñî£Ùp|éÊ¤D>}²KGÕJ7iU? jÆù1Z`÷hLæ7¯5utÖMëó}Y¼ÇÜÌÀÎ0}Hb"ÕuvØ§´¼»keô 85Í ê®zÃ±¡<ø)¯1ÀÀ[W®I áGòxîIRMmP Gku¿_#h*àîkãúÉwcÄlS¹ÂôóAN°ÿUz/%á*éd=ÎI·ÂHUÄ³6~Å96:³Ôa±m2%oÒ¼_[®)ö CgÏÄÑCÂµ¿L³t¾vtò±jÛéùÊx¸åRçQ:KÔn"÷Tè½®ÝnAÀâÍñAlHÏëbCÑ-¹vï\*{ðìáE®|G6Ë$^oÜæ©:e¡óPnYPõô-`yÔÖçÐ`y@!ÉÏIì$÷J¢í¡X'âB½."ùJÿ¯"ô(tÖf§Dªýa´ýóÎ×|ÊµrÕGò#Q2$¶Å½ÒUèãL>3Pzh·0ò"!"¡À[þÁnBNpÖÙérSÉ5E5TæÉIÆArÁFÂÂ¡Ê¨!:¨3Àþ²ëEHÞÛqáÛ?22ÛÏÍagKdllÓ¡å m^D¥ýLÛJ+ó+nd* ÉsztÏ^@8 ndHê¥zËgÅDAÜdPBööpý¬ícXS7§]ÝÙÐ¯ín}16Íá_ÌxÅù²;´H_Ï½mç´I|ç^ÅÄN~¿VýDî©wûÐßÄá.Õ>üÅMï½_ ÛÞ4zù¥aÐh±!á ¿Ë-Å¢T·JÉµ¢mTlQWc\T1åÎÕ¯ØtôÌ)^«vØPHF+aÃáá#Q#ïÄòjUÐDb·_5×^Ã3ÛLû\MmÏgÛÄÅ|¡þÑ2F÷yJÆÂ.r¹uð×t}£{ënÉü7ÊtO(ÔéUé¼ÛÃMöRBº+¤×hÉ%[WÊ<ãê$k:ÝÁ¢ÖâcZÍó~=½ûØG]ßtM(GôÛJ°ol&ÀÔ.*áCm×¿Vº>ÂRtS¯;KóÅÇ@ìQºA¶wÃ5VDñù"Fºn7!ÐdóèÛÍªô´±6û{ýÃõbésZ-áÅQ£Z¬Ç:ì$sLõ;6b¸ì¥J ø®ÜúÇÃV>ÉáÇ^jöûkÜ¡ãêË¤¸q`®%cÕaÉÊ!®æ×+AÂÿ7DÕøm¿ÌLÑýjº9í%Ê5þÔMYçÜ¯öÜ+û6¦¡"ûv¡û7÷ç&ï¿T¶(ê{·½§K÷ïþwº×]£s\;FS+¢õ£j¯7²+ã(.´5ø½FóSû¤©8ù¯×!i}¦&©Õ|iÉp«0vì¾<àì:5 È3Ë#Ðe=Éò÷Óg%Æ¼HËþÎî¥]Ç¯S?$æÝ·Þ¤{~õKpÎ¿¹GÌòÂW¶å3o¹Lùo63Â ç®Lëò×kTr^yH½HfÂqÖ-Ö<¼ïB÷òMMðÛ·´ÆG#bkûÜ>ºÏóË#ó´¬ÓµÞhá{¶ÐÀãm¼#]p¢^FÀöö+¦qÒwSä=!E'Ï)U8l=<ÉæÇ+HXx§FØHxyLCäÞi¡Cq¨þÒóØEëð«£»ÆøÔD¤LÔBqui/Ù¿x%ìfG-©ÃçÛ´çbß2'¾ìvÜ¢²HÎÑV(ÉýüÔe³ö'òäÚ2Úõrj}bdMnåj=l¨kâFaÁ½paj[)ëF3*êuKÍ«LR?£&ö.úôÚbH¯Ùs#4¤>÷ B6'4Æ>YÝ~+ã·6Î ^IúMNzU XÍR$²/Ô`±jñÔ;Nß|Yú+9W×Ôný¤åUÂG´èUuìÊË=³ÝawO%Z£Q(ïöÙlËÅüa-xNr÷ÉQjµM8¬ÎÆ(Ø$££ÂrÖ@Fè"XxBÑëo&÷Ïv!½õl0¯Bý«K4ëÖ~¬àåªâSæÈÚwI3¿ó³0ü¼QÇ,a©wÜå+±$;âS&¦[×ªÑéÖ|,N<·G:©ô a¸3ÍÁ? ÏDw²AGõ$ÑXLKñC¼37³6i\åÎ[ûH¼Kwk.Â©Ê½òºÛHöµ8_xÆ½¨ÉCÂ2ò)@îÂµ3¼ý¿¿ÆâO÷'mì£ØÄ^°¬]¹ü¨pm¼:WÐ´âJMÃäè`PÒ!bJÎ«^¹ç¬MZcÚ·ð`#è3!Eþ¨k³C²L¨ Ý¼ *RüD=òÁcÜ$Ôa!2"ëa/L£¥øhñ8ñ+X¹íyjþ_ë"¼`Ãä±æ½µ3ÿïbcBiçØ´ÆªS!®¦oÓf\]¼PÛ@'üéTùÃr½çßÅ¸%;»\67ÂJm¨zÅ/ä>ËHËÎÖxoõ¹û¿ª¹´çkkÎfgR3nãUÎþ©VfÏ-ÂIH=Ù¿*8$hêÔµaK{^}mêºj´hÉ>²Tq2üÄë*²í*4¶¿9ûmK$"û±·nÔbD*QPþt¸-ÙøAÜþ¯»í¦¨ÑÒ¡gtÇpPRè`û¡\þiµ\¤à±ÂcHîîrà_4d}_&}ßã²cóO×4¬íGb$LÓj¦ÜMÿøñÔ©$G#¾½%LåLý¥îÌxlLCèSkæ¦ýàRi|Ü/c/ËPå)tfOñY¹¤±|è;S#ö|j»x½qÒB;; !Âcò ¶þ5d½kazëæFFàÃiO9ìÂ=:Âms£`ÊÖógÙánk£Øj*·M{¼b^ûr/EU"uÖÂ:Ð§âÉ.ÐyºÖi*.ù>RWV8òëÍ'0Ã¡eÐéÉÙ ÁA^¦p}é{BÑ.½*x°î¡åÎ!¡C³ßY÷E ï;Æ½t9LÏ)zwD¦XþïOáÙìDA9º8ÍÃê\"ªûvY u_>&=×Û§ÝEºÛ¯¨¾U²[ç8ªË#7h3ýý@cf¨¾:m®^ÑÍÉöäÆn«&H¤i]pÄç'bìæå~ïyç{§§!fÛWDk_Ipì#ÐÈ¸"Z%ïl÷ý;Êüé)âZª@émÎÌÒlÉ<{Ã&ÛV|ãFr´þ!|¾xÄe3#3Ýqhyl&á%9fi:Ò&#¢Znkâm¨ãù;©äSü=±´"Ûìé]%¾ÑrY·Ç;õ-Ó{Wñ°NãúfJÙÙ~÷JG¶!,ìI4ÿàäÑ OuB6©ûû*öxNÓj]LEÙ[fJ\i}¼$¬íez^³@Æy¯{¹båhã-ÍªÇ;X6Y(¾AEoô¯~ðXëuÄ obÑ[ùÿ'ï`-æ<ÿöæ`«¬xå^}þ¯,rIçúÙ{Á«÷Ùa:toR²ÎÞuÁº¤óÝ¸~é-Ü^9=¢úxpDk[Ý§D1$êhÊ|±h+:bò.Ãq«aÈ^AõÝ2Â×`ödd¢ÿÚi Y<-¥Ç°Ë<%RnXU÷ILí}è®}uçâôKVPY×àÏEã){6 °NØhÊ}käÙxH°I¥Gë|p~»ÅîjÆB¡úÜ/OÝ¡Ë§x>Ó¶TËª2Î&JMÝU{kW¹SFP8RhMÑIXzªÿ²ý°{¦?ü´rù=:\Ù*$Êé¢2,d+§æÌlý¬?üýÅ&\¯¢(¯y0®{Rn'D#:Ã(÷ÉoòBÛÚ¾Tá|VºÀ^LYþ\Ëä2Yï8kÞ1ie/-U©pT)ì ÏÔÛ@>]Ö>Q¢ÄqvÞâaPFuþ»í?ÍÇëvÆÖuèpÿÛ;[èa¼ì(§ÑtXï7ùp~ÒÌÓ½^Åüyæl¨©lË-Ë=*ßãÆÅUj6gÓË_Yaé×.Ì3>áköÑ"i¢aã¢<þw×æ\§ï°PFÇåiq¹E|lH÷Ø=c¿jçÌ¹ËbaÒÓæÇcc)¦DK¿ô%ÛÒfqS]c8¨«Q$¶É+|P²¯ÿ-¿lÿ´=åikl$¿\hÇR&Vdô¢0ìEU#ä¨ü_öL¼2hunÔ·ÜêÇÕR« |~Ev¥± ñm½ çì2,aOît,x-P×ô£©=,K/(?4÷Úî,O$q7Gþ¶<Ã¬3ì7-¢Óò:9B1qf§,7~=ý&SóO!óÎÃÂS^)ò$ût_²¡"Ö5Ò=èèeèð?Ò|¯¾wàòÑ*'·(ÿ j§úuïì¨BÇ£».¯ÿk:$Dk¤å¤O)Ûöc(tFhË£Õ¯ºrMsE'óôû\wèýV2×üv)Wÿ@'eÉv0p/¯_ËuA¶êÕ¦²æ®ó#ØüÐ¸à²ªqûàYXú)Ïà§Q´:>säc&èëÊk"WTk°A×dù¡SQéaVt&?iõçÅÍ°âñçÇLìÖ©m×YÃ.{Ã´ó8!$¢gÍè1 ^ÚØ|Å^Ë(¦6Ux{Í)HôR¶!xkNv sP´¶/ÚÙ(J×Ä;þa©õ°²4aEÊ[*Ò5SÜîa§KF÷@ø[}§"í{þ"ú*ÚïÛü¹;°Ò²¥3iP&¶°,«PZ%éMIì1àüX?TÏ)@ë"ÊÙX:Îï½S2KUZDÎ©tÐÂM¾F±4S¯Îæx!¡oÍ§ü&VÊ¼Êw¿Cr-b®»¥Ñò±Þ¨µOþR aëûÿÛYþWêMðãòC!#umLÕöØ¼9í6L³×Ð1Ï. ÚRn|l8êÔ¦7¹Nø[j¦ÄP*yPOknâ.JHÌfÞ#½%»9¨#f¦ápÂ´ìJ^ùU? ¡¬ E±)#µi%ËÇ¦lDEí$ìo÷ßPºmý!"<ÛDÐâ0ã¶þ(Ù|} ÖjÊÐpÏ«hÎ|(V+½tÂ?nDÍ[±Ã.%ùVú³âã;ÓQcq9^b*hZdgÐÓGUiä5ÂÿÛ¸üËÆ°M-ÌMÔ¾¢°Uëg6©éÉ+ÔUÄn.LaÖHQíåôFÓÃ'ÐkZúCN£ÿ(JÍK¬X§²0uØ{²ö!íS`¾Ó0xNrÀs)¶?F^ÿ÷°²ÏÏ%©Û=øÁ-ì+AX4ÇLS²êD²¦¼c%Oh:Ê+dzÆ%qÃË=áP&:±Db8ÕwãévÍ5Aí ²×/i7Gñ»y¤1¹IokÖpí 5?]CâÔÀu3* XS FJK)WSDêòa¿\ÛÔUeåp¢w¢Jüu³Fÿ¬Gìë²ºAë&cÂ³ÔpNÿÒHÆÛÇ»à|Óx]AyO3ñ¢/{ê;ÎÀ]voA¾ÊßhpÜ¦ÝäQ¦½#ÚuJÞÎQ´Ceû#×ý1<"çMvtÂFêð¦7ýñ·?¿ÍÜ´[×Ù¦f¿ÌZYÌXL¦ý¶?ãöêý0µÍÐ¹Â66gÉÖ$à×!Å¡Ô!ëaMÿk¿©.Bz:Nhòò°WÞ6ØYUñpÍ3T¦®ux\ÊÅ(ã/¿«Ô+/NMÛáß\ÔçK#pÊåAIèoêø8R×$ÙJÖ×P)ø:ëpt¶4\NÞÈ»LÚ9ÕÝJEØ½G;1ïi¥x®ý]wçwIêÿ}ù¡¤æ(¯ 5(-Q!EeûøK|Æ¨äzÞC/}-WpµAå?ûÜéY4ÐVùÏÃÚ;²*nWÙÐçÖoûô°adT\VÓ¬ýÐÈïE(sÓ'kÒdÁx5Ø©¥§,¨iO7:4Í×FÂç«Ì>¹céwÑ{¿!qÊÔ=C,s$f>´¶}ìªþÍ±\®MÄ× üxbê §Èr¡9ÈA(j@c4B*aíP/Ë`Æ¾cÕH|I]ÛC;ð i\ß[é0û¶\)_0Ö3÷:ó;É¡d>åÓßê§Åª(~éVíÓ#¹E~D°½vÒ\%DE@ 1?Ì¶]]ÞSF»V7ÈnøæA"ÊÀ²Vþó3â¹«OÆÿWJÊ.ËDuXÚKYaæ7¯i^å:+fçkAìgò±ãköØìÎÙ969>¿2F¨Ë½ðÖb3ï®ubÏWÿ.»Õz×v«ª³¥Èr4ÊÆF%Hþýµx}Fx²ÓY±x 3wtÓî¡c¥hPz*à¿)óGß.ÅÏ+AkæâzíèV¶Îªj]Ý´![Áì@tÐPXsãFúk×´E%Oñëò»¡½ÔËì"pSM_®ÿOÆûP#«KÖ:&ªÈ%H31Û8áQßø;jÁªd?ü ÑÒÁß!Ø¹YÝà²«*B*¾²S§ì(oiî:y¡¨£ÿL%´4ódË@ïåo.aLZiznåBñk³í¥zâË¸Fx§qVÔCRkg)tZuñ©x»t¿Î¸`gç!Îò]¤n»¥S+3éÁÛûÜ(zêMtãÈ×©ó¤Ë`å²«ò¿KYÂÃ(¾á_m%|U$ÝCçe7_CÉ>£Í4K½HuBiÙ§Û*¡¦äxã5÷¯þæÑR×ÍrÇ=.Åc`yódóä Sù`ÏÁÀhWÍò©O®æØ·"ñ`µÄkedí æhhêóâÉµJVÈc !^Öþ²Ô/õqôµ2SrEêÁ_ÑñæLö^Fè¯'½,z¨°ÄÆ{h]¢a·,td5ÇieLúdZ{*Õ¥«>[Ï,Ø5ª5üýÚ]h×àB¦þ-ÇÖ¢Ïs¬ ÏvC#jöF^Öîæ¹òOW#uªJÍ>Dwì.+a0«yÙÅ¡sºDFªÕºÏ tTáçn¾»4Ï9H~ê]¢ïG®'mC5@¾4J1<ç-låî1(L«Î³Ú«eäkè[wö{ÈÛÐmà|ãi0ßt¥ñõ¥åsj?ZVu¯²Ûo·´È:ÝåFùÞ@FÍ.J¥ÂÔ² ^m":?$+ÆXä~¢A^§ëT·;ÛK¦ÊrÒRâßyâ!öÃ{¤L4/m(kH¶ÆUýiâPÞ¤M£%<×k¯¢}I"TCøüc1zdGëCeCµ|"¯~XÁÓälTd&Ã Þ^)cªLjÜó«fqdjL:Z&ãàáßJÖJÚæ'vÏ9¦frM÷çèû<=s¾è~Qº[îéY¦ä¨¼sN29_±ÉÂ×yÖ¦{î8$r¤S}.! ë¼qòm$ÅoWcÁw1úUmýï'm:etÞñ`9(d_81ÔÐ®ÂÄ¨sKJ;ú±TIP9-8ËÏc®a0ÚÍ¤lW}aAÚZï:UXÅ²ÜFoÌôÀÁs¼Q ËÆ~-/ØcöÏ³:ûçüÔ¥³ï\ I·èzoFÛÙÃÿZ,Lð&X8'æ½·®Ù¼I²Î7V7íiã½¸ï%}4Ô"#&$$þM;·Ù¬¼µ9ñs?ëH2¹Yé/¥}¿\´êÖ7²3úà{kZ¯GÓ ôKau}¸ÿguL'}<÷Kú(4²ìq«|µ60lëgÉS>HVcCC®MÜÌBõU-ßè¬XØøòm;ä,Qwsáñ7¶üH¢Ø¤¢yvEÉÁºRÞ·ð^F°Üy0ÄoohÏæø;4ðß¶_PÌ¯#Þ÷Õ³µËú1ÆïQvõ=:öM(õ¶wùÝPûG°óZ>ã%:oÍkØN3UD[æï¢ÑöàãÈ4bàWëópSO@Ìãi¢öi8Ê"L|ÜÅ½pM:¯ÈüÞw«zèÄc#b+ÄXv${gÎKvQ¶Ü§QÇâÞZsÙó-ÒK6$¥Ût¤AQÍÊXy`uWêÅÊ»ºðStô}Ik±%D9¶<ò9U(ÞöVL×"ÐkJ6¹VâÕ®UC°þºÄ,ïÑ~ûj1ë£g^T¾óG¬MàmèøÛÚ¤þ.TÿF}ì_X¾²¼«u»½nn2EÄéºs7MÅéWqù÷¸yÈ^r#i&xOË8gÃ2[®*.4Ý°À#r¯'Ý(Qk\úÅ²këÝm¼ÞE9\8xÏw/àF+0(z¬ä¬Çj;?Î}ºÈM¿³èP0¾ÏÏ1ìÿ¥1Ã.¼¹.f'Pµ®ÌVwgÏÙfci]°yö¦ÿÔ0tõúÍ9LåNisµ)¨âKí^C8ÙÞÏßºßqòRinÏy»¸HÓ>Ö Ärõ@¾:äÃÞl>>T/ÄK««Ò %·ê{WÊóF÷æ4.FáØÞ¸ãZü´V"èþWfæøFÎÍ`´öÅ»ß±¢w@4;,dÛMQ\µk$ºÖ^Êêù X4IS¼æ #ç:FÊCCk¢èíj¿¹Ú÷bÝ'WÏRQ¿àGðw$öþ Óm")"kæ2h¦Ow¶¤ÿµ çÑë&Õ.+ä4T`_|jvZ¦qxú¥_svãaQ¸eµ¹hïRKèìÌÕ§§ÇD¶H¸IÙ©¶?_$Ã´¢V´W+ñ?]ð5!?h¥@ë.Y^+³ À\Pµ=¡ïëÄ_ÓwadQ%8>S^¿Ud]®¶®{ÚE1?Zãå£fþW0duÅ¼NïkÜ¼VYpÏOGÆrÇ©JÏ]z0:ÿs3¾K¥fäRw>º]ñgtÚ¡¦}çÐ¸ë¨í')³,Ã1º$6×q¥ÝLßßµÊãÜëÁa¬xd¡üÑ`Ú"u#Jlzqùi73e*PÃÙ(=#&dþé$`éè¼l|Å)Z¼cÏ ¾e×¬¦ÔÐâ³ùØç¶|zhAx1xØå¥CÜ«è3-Bíj¸/òÈÈòém°|îoÆË.×§êw·½[|-ÁNÙµ¼M(+~ØÌTÔ²¶ôÎ©S¾øY51ãO2döj!ï{Q|<ÎbUhÚ};ä¥fàj!ÿ4+åÞìñK;Ð^µ?üÿ·ëS}×h¿Yx8WÑ¢Y¨ïß:'HÇ8(wÉ §õíE´F¨NÀ×#%-b¤n9ÔÞ¦U1BÍº;¿ö*<í £·ÃÒ.Jo«_Èäu)0(Ó·äæPÁ6Üø´pSëÔÿ\|q.ªEþØ¨Î£F¨³g-Ãµ±]ûëJÌÁ±ôNáÿáM&B$ê³&LR2Ý¹yf,â¥ò9òä-~ÓD¸Èø(Vá)Yû¨¡áÇ2 |¬fÑoµ2{/SÈ8ô4ÜÔòf«FpGJGévË7¿×ò]í1NÎB+£´º~E"Þ¤UÑÑ«:×ù0¿@üÂev"Ú6ÔÚmíîpG½²æÝ'ó}D ·¯JÇdÚ) áLç-JèîÀ ju[ÔÊ4HK½'bºó!C»ºz¤g=_L:-tólÓb# FÑµÄ¹d¹àÐzöHüEÃ"ÏÛd÷;3Ù«÷ÄGóð Jôö?[Íå]äXÕÏe27j|o`,¿G#ñU/¬u)+Vkvé8BÂLÃ<î,û6*pxCå\¹.>\]ô³ïPÃ¯dûDÇQR"[î1ÏÒbiÖDuâÖ/z-Ó|\ÚJZý¾[8ô®bdz°*l¾¢(EyYAìÀ9íO§n¶ÕtcÙ!ÍAü|^GT5ð>Jå<+)âJä¸E#kQªÅ¶ÔúìßäàÙ×áyNÕËÎñYvdd¦¸Ê3ÄÜ#Í&oz8ÉqÌÿX;lµÈj¹ÊkkH}ÙIò¨N }hl8z;¨ãüÂøþè3Sèíf{8*z=þQFûVØÞu1£òjðS«(*oCeÙÇ9ÉÓ*Ëk!Ô9¡ëT³(¦¬!T¸¹S« ë3(8ÃÂÞîÈëÓZ¥é¼v[+Ûï^tg"tÏÄÙß ßÜsBâõÁ@c²ºí2¡,o05*lÞ'-G--Þ¦Ü â¿tV£2æ¾Z_ÅõÎÀné|Qqº=!b·<¨éC2à2+×ý Û96Ö¬>Yí.:IpâÞLRRùË^ ÑöjR2R¹u0çªsÐê(¹«!¾ÙëÝËxò&fíþ&eáJ¡K¤=½Þa¸¹í®NçgÀÓ1^%_é'5BsCê±rb¡×óúãP÷µA¼øP3sv=ú¬çÞ1ÐSÖµ!Ø/U#Ýå/úªæ|*Pß£Å%fÀYj®ÀïÔ¸Þ/F®>U~K¦´k¬m.;³Ö`×n`Ð¸±'ø:×TØòVßRc¸ªe¸èÁ´ì#IFÀÐª¸Ä.ÒÆ°×u}ÐDNçØ)Wçá½¿6Ê¡c xdVÛwÎZ!BF>l8}ª@óQþ8öokÿÏíjõ5£òS³ì¸³-5)2×Ì{À§pB·[RÎ¹S Òÿ{®¢$Êº¼µjÞ9%ã33E>yO2- mß*Ô°pz[uQ]d/*«R×)ûXÌ®â#;ú4&×½Ôá4$²¸NªVªaøØ.¶®ëâø»íç[^¤¦å¼KWajä8g"ôXr6qZKftF¡ÇNÌTAê#¬O¹ÚëC9&¬Î´g8¦éGY5©¬×TµbÎrÿêü®"ÃÓ5To;?ÆË)ýaJxHÆGÏ¬EÓ\0ùî^[X³ñ/G41'ÕÒéØÀ&Ìå¸Oµùå(¦ÿe~nÿE|T»=t±õâ}sJìÍl2AU$ùcµ;küC¬Qìh¬ìHt+@¤¼·àBy®ÆE£Ä9¨!M´.u§&pxbyÕqã}eEÍ©RqðÕn¶ö¢7ð°c&ØHFBU«ÛÇÒñàÈøß0¯´¿¿¨:é¡ÍÓL,¨u¡¤9u=aë.Æû%jÀ2KçPÌn9´öÐ'|ºkwÀä°Tô¾µzuÈÂñ'fõ+Ú&$@ ½ª`?~Q)§çÝå«|8ZVõ±Ê¾ðÆW}É!fD·KQöl¸øÔi7wp°Üj\ÅÙ-èÅ0SÑ÷?_-~Àd>Ø²»Nf¯ð¢=d0óQ78NÕ®É¶³® "{æì·vbÞ£¹åèøMÉGyzÓÀÂLô²ö^võNgÛ¯ïéÍÀA»ü©°øVb÷PoPUÁü×U~±x¾Þ÷®×Ô´$¤Ìb}ÑSÒ2²t¹ØÏñåV°ÝÊxÀmºcUóòþwî7]Ñ(QûeE|!>ýHi¡È:Pã@V[ÑXGö²4^Ì3F«8îàaXÅÎÂë/hG}´ÉðÌìz Æn&ñSHÐÄÂBcq¨eµ, Å=go\NDÉäæð2(ÌÍ¨½÷úeQîk÷MØ¸dÜf,ÁGs[hdHÀ]äEÎ9_~j2ÊÈÛª~«^W¤^W~yÆ/=g,Vôñô¦*@ü×ÐBÃL9V1(ÈÒìeH_ßp:æ h¥æuf øºÀGÐ¶gg$÷z-¾Æò¨¦>úíÒ¤t;¬;ÙîyF[C3#à#¸Co³®¤zn:{û5ÇBµgù×8M*O´ÜÌÝèÒ?8¢¬ÀßRÌ÷dù«7\©§;ý.º]\Ó¦û9iûÛ_GåF´&ÉÁ5u}ÌuÝÄ-'(Óîå04[e¢ú7z|ÞØ|µ°XÖ?2Èêº¤ê)ªëà>[®Ö|Ë ï1U4VÄnÂ 3§ì³¥ç 1¯góTËä9ß®ÐßÞÔ¢f»¨µMÉ<þz}D.r0UºÄ8íÑ«úµÝË³eöÍÇÁ¦>Ù=;o¢Ô5=°ÀU=bKLÄÅÄ/¿2U;£õi5Ëw½ú"ÎþXN&÷+Bn"°øKàõA»á¬T a60©äÛ\ÈÊó2qªì²Akñ6îÄðy#gOÿÙ¸6íÑòÈ3%máøF5L³¦?´kzåSuÂ>#Æhnað)¼m*.8ä¨?¹¼çHÆCÝãïV¡PÜriù[KL;7õ+_^]#ø·®1©wþeK~! Àåp`}á=&ÐêRnâÔ¶*zÀ{ÎÍá|KZ\îó2| ÒÊû³áè¬:Åûct úuz-ÜKp+ra ;M2Û± T< ù2Ig=ÖÅlèxåAïËyPVè<ú®5ýßÒu`¤ç ì*oü.VàÈl ¬mË:º¼ë¢Þøü;¾%`wBóÔÇ«@ùA¿^Á*ImÍø#2'.°n!éÝ}.\Ï%tÞÒ$0ûÃ\í:næ°ccY¿ïð®?å<©n²æ}MK©ÞÄàEe²-ç¯|ÌA7¦*ùªí8QbuÜ3iE7cv*O]oï1JY[4á¿óDT[<Ä.äkÒFB²~æ_4ÓE¼;A®)ÜûKYà6=±ý"Öf¿KñÎ¤ÐGNýwû63TÓ!V¥ª9ùr®0°Xò!ÕÚ©¿kTkc³ 8Ð¸¾Çí´o](%ýOÞÛË9õcìo}Ö´ûðáto`8ÖmQÑïïôÕD¸íLZ±ªÖÛ·¯wì&=oÙ2'vi6»ê¤$MD>ÓFRÀW7j¨¢r¾$Û×:$FäNÔÏ[ÂBÊÓ¡HèAØÛ%bÇd2oêô«>Òà$×âvOØTv¼¯|R÷*½;{ÙÆGÒË$Ò¤/EÑÉ_½ÍÇ8AðË¬áà^zü§(=¥_èªI®%Öé-.Å®"¦Ê¨ÖÉ§!(&øt~Xº²jpç·Õ aÐÙÚ{°2©îAä@t±x$çßøÆv¡l38)û(Ë\h$r*x=öDúXª!W9)yò·ÛÙîNäQKm !JÏëÊiVÌ[jE®úuNî]°êó¤&¢xæóWE;ßÊ¹ô+y¿Åò&°9 ²ü^®bOp?àJÓÆëS%kQ®OÖñ¶'º~Èó\´{Àm¸/ÂÁü%àËóoeªÏÇ9ÕR¼Åg^aÎoN|+Ö8ÔjvHCf©â¼¬å¢TÐGîµZ´³l®zÕzü¨Ót¥ úâ.¿½ÆWæýïÑ¥3_xã{ÙND¿æm¸rßy÷õ¬ky¯ÕÀjÑsPÝ¢§v÷Óæ(ÐÿßÃ;¯b¹V|^¿ äèx'ûH¨{]®ê{pÃzü¹ûÁGÞÆbÅÑéÎ¡]c¼#È×Që78/R|UúªG÷Îsæü>Y(Xãn¸f¿OÏ>RÎ6É(ÉKôÆ[i=n]øC0µt#TrÍ_uq×½³)5H-ãÙ'À%°Äî.<õ'PÄ Á¨@¶ nyþÎ[Mö|=U@ìóGÉÔª27!éjór°Åí>S÷{_5!íwyÝOÒ:$kB·|®¨_CWÜx÷´ê¿!$kòªSÿ\ö1ùêôqB:õBw(ûÂÌ2º%êGj©?±îÙ3Í|)Û¶öx-î©à /ê¡«¼íý8¶Iò;?#uFÞ¹3}\1Õ|xú¥ÿß»!²£¬ÖÇ¿[ß·04f¯´~õc®¨êjpáÈüökÁqù~äZ`2ì ¸¨ÅÄ?äó¡êÏ.å"à²?LfhYª¹D¡íÅ°»nk½OæK4£üÏò@\úü$KªUÛvR¡£2NXæÌZ`+OàõóâBe|ÑOäY'ãøæßÝE½¬w.f=yOî!®ÄbïË:k±ÅÜ¼í5é²ÝÍþ¾k-%J£B{TõBb¹"òåï¼h¤åadþóéPtsÜüÍÌãù¿éÉÔ=ÜÑ¦qÈÂ/¢÷JµvÈÏ&*Â~&e¦øH'$-÷!1¢Ñ' îÅ½*°dËFnsO Á*î%<Æ¬ÇK¶*£pòa2æXÉÆÎ¿&Oì^gÐÏ¢â#É$>.8¬|Ú³Vej·TÝQBûO«o±|:ôìïêéâ-c-çqö¬_ó%þú*ÌR Î¾J!¨êYø½Ï(b§ìÙ¢¡³Gþ;[_!ÉÐ4\Ýä¢ó@gö¦4Qan(%!ö79H:õ¥òI}tFû+z,{è}ä_þrÁ°À¤2 8½~ÑëCSðSÀ2æFýøZ´\äYÚ¦ñ,ô1ÁÞ`§Q=:5gÃ-W.ÜÙ¨5¥cÂ×9Iy4ñ·Ñ(PÚØÉv`üCRÀ´Üv5õÏ$õÄç·Ñ_bªÍ´QOrUW©N«©/ÓÇ¾Òc¨u^ú)"bIm»V¨`0Ê®À<@ïÂIGit>ê_$õÊlÛ>á,R_:/è¬Í Xp ÁR1íòT eûù+~ðü¨ B3ûýÕMÅ±°ýÀÔv!¿#w#nñ`iåSh¹|ÈJÍ°ÓÈA ªUuÖ$Yµ¼U«er=MÃd£Å~^ØeÁ2¢r¬^ïáRw\*Þx¿×K+hÀ63 îYÐ¤ìêÛtû:H8ø^b´ZµA¯Ãê#ìñ`2¸<Ì?aº£¶Åß·Øw÷êSöãr÷uÄG±òV±B_ì5ÜÐYëãl}»Í·D»WÏD0=°×L"]ãïè¯8QÃ"ùulMÀ(ÕZØ:=I{Ð2îîôd_n[Îïyuý½/ôF½ÚÍÛµá%`ã"Ü$q)ûiË3ïääÿp¡EvL{Ð©gJ*Nv³ð).òÿiUÝÉê_ÇR¸I }qðHjíh@º©pÇ ¬NúË1î«/Jc0³¾jàªz#QõßBPæÓÃ¯S2îL|Ûx5;ÙÛÍ_ï¼hjâÍcËªÀ¦ñùF9LzQºPe(íYå·fÙ/{O@ÖË_ 'lXÿ%-ím¼HRáÐºMG;ÜÆ:iM TB«Å¨ÞZráCw>GuuùÓ¾-/hªy6ºÊm¾ºÝc¬)üèe}§îªA«Yâidl]ZòA×ª·J»Â¨3©àáë¡ýÈÁ{8POÏö!*ùþ³å«[ÐüÞ09$¶üÖvÝ=TÅ7¥î¢þ cú&tÇ¹_5Ökìj1ü·¥¶-øVª;£©ôiÒÏ%Xº"Æ)ÛèÜYW~jçOT[É¦Ò|³6£úír*Ù.^wù»µçyim¨~ðÍ/1<ò¶"]Ö¥Ã¬_ë«`ÐÐÊÊO0ùo{I¼"" 57Eêë½diÈ*²¸¼Wî;¤Ú#¾_¹Vñìb4Õòbk¥>Í Pr×'ÏèsÂiäÁ!^°Þ/8ÕÇezfè ùKãW4ö.f¼8!ò\/ÿóUÅaíÊÉ¬Ë/ÉúAÌb:Kó Æï°U(nÁ»ÿáÉÞSú6Æan7u¸1M¸?±PºÔÇýßG¢ôB³¡ê[ãQóéÐ·nÿkq#Fð¶Ê)xº7Ì!À¯1õTó¸IX9hÌ©¿¦9G"S÷ÃìÉw¸ç¢!Å>]ç]Ød,üÀ&xÛÎ%å5ÐÖn:®CacÎU»5Qµ±¥ÏCß/åCÀU»J;p}Q-½nw=vÆ}a(2çbÖ©Lu²÷íÆëÓï§p%]¯rü½¦ØpßT[e6¹6þcÇwö1T¶ËÀ³fù%ìkåñ²×ö¯}#jzp9»Îï¿ëQb`ñàÜQ0k;ÙbQåú9%Ô¸r¡¾khöì²-8ÐjYy,ïª©Q#ø×Rú¯EÙ5óøa'Ncã.y÷QTÌéyEà¸tøöYãßKÌÕe£dþ=ãõÖ{µ¦-fX%¯´¹å´¶ ÌÚ*|©ZiîQÖAÙÐé¼çÔ¬¡5üâÄîbYåÌX%'õ÷*(Ýº4CZÏÓúøÅÚ>Íz<ÌìõÓGÎRÓÂQl÷Ðm¤ÖnQÜ½OM_]UüP9Zk:¶òÞÈ 6ç¦(}¤¦jß+½¨oÃ(KÀî8'WTW9NÄrÉë#lö}<½J\¹¯TÙÀÈ`»Sö0ËÍýO>y¸Ü$Ù`4tÉ×ÈéÃU~~PÄ¬ÅïçØ {3~ïËcä<82(£µÛ9°Då¦VØñ!G;fCÊÉÀË#UL2X{ëÙÖfY?KÀéýãWHq$ÎPô(v¸asúáT$Ø×K«ÚÈá¡5/å¨¼|=¥ãé§]5)@+ÅjÍózÃùÖýÌ¨¬©`K¨EW9Ù{TS_e°2ðúQ3%Áí[`î^+cC_éX9óß7òÛ-m¯¼mÜº¶H*«Ú Õ÷ÜÈx@=gÂ½zN«%{f^g5ÐÆ·PI5:â_¼o áÍ>¡á!Ð¾MÑxIPö1Ú}üÄg¿C&è#JÔÍQf]x8ÚÎ¡7÷öNX§¤Øô""¬\ð¨pTY¯ÒþÊÓáÖ¼´Ú+ärpiÍñ]<}t¶Ê®`©í¥z}ú~×ÝA ·%ê©¼ºÈ/fûB²;Gën4«àB!\J6O¸qxÚ¦Â§vñÉ÷Ír¸§ñß\Çú`ÿY6a8¹ú£jQM3)×5C®%À'@'ààú±ê@Ëéû»àÒfÂÈ6eÈ`¢Ñ;; S·¦À8.Ö¡ñ¥Û$~zãéD@¸¨JÉ}I;[9`Ë bee=_ñg[us$»=öTk½×£c`1ÜÈkÊ>ÕY&)/²ÚrUCýf·ËLpÅñêjð0¬Ã"¯äp0yó¼e3¡#¿Mi¸e<×K£Sú¼M·yZ¿myÈ¿ÛCÿ·úX¬»ñ+\TRãr¾&àöé$·îwoP´øÆ\çñ¶§VwÕÏÍVEOVóK¡!WÙL¾íÅB®êWÁuºZ¨ëIW¯scöCçXþ/.yðöóòËÉ¦`§bìKDúênèõ½ápå¦¦r8ôÜô" HTTP/1.1 200 OK Date: Thu 29 Oct 2026 23:27:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=64 cfOrigin;dur=135 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rHEhVfReeE9OYe8F9ArTMFty0oRbLsCrzIV%2BAUxt%2FNernxP3Jwd%2Bg7o7SpMeIIk%2BroMz9kbruDVeeQAoSKNIf8%2FN%2B51y7PkbUgxwgeYYUdMMLFQPk7HhJD4SilTD"}]} Server: cloudflare CF-RAY: a525f3f6ae26bea9-ATL alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: clipboard X-Chunk-Index: 2 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 187 Host: farenaw.cc" with payload::==> ">I`<¨ «°ÿ1.u4£Ýßµ`ÄÎqÁ&5¦RÙçþ¸PýL#B«KWm¼lYy$Îè¾;Æàj&¢èLÐVÜAÆç²f!d3+¤{isãÐF¶½§´Ä2À@ñ©hÅ@ð84Ã-ÅåÆÃÈ5tÈüÇ(áùå:¬ï¨ÑG{¯/d²ºzë;ÇU]HÎqt´åµCsÉ¥Â<=" HTTP/1.1 200 OK Date: Thu 29 Oct 2026 23:27:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=14 cfOrigin;dur=117 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OhruL2snO0P0Aiy3mT8eO%2FAbcDOY2lJLzzMta8%2BOIguUY4lEy5h%2BoN8YGUEvEpU%2B7YERKYHGoYOnx3m868mN8SdWihVv0oNyXkzOMBdbkuwZ9DKs%2BgN3uN2O7v26"}]} Server: cloudflare CF-RAY: a525f3f8abbabea9-ATL alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: browsers X-Chunk-Index: 3 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 4230 Host: farenaw.cc" with payload::==> "!Htº/|îìã»ôó*¾ÏrXKIVæ¬iA±¡3 ´ð|ÞZ¹|d¦+6"Ú¸wß¸}`ä[PðèêbíZNSúaÈÿßpÊåOK,åj¨¦¶\¥|©¨FïiMÆºPµë]ñcìô°ØÁ=ÈKW·z;£á¸<Ê²ì;"Ñ¾»hPSÀã¯wç¿ÏÎÞ°ª×y&Æmö9(Ã}ÿOöêÜ `~ÂM)öuÿ`Nø²Þñà&uÖw¬h¤ÁÔ9]çÀ³gw^FN/äyÐÙ´|=èP¿Â+q×Kö¦ÈÊ¹aÅÚ)æ½w3éD¤'°Gçá¬´Ö"2Ó°6¨ÕÌÚÕª0lWÒ Æ5'!M# "T`Y3«y K_ ÊE(xÕM0v}Í¶úþÁPKHÀF³×ð5?²ÈûIþ®û\ÊëÅ]H£,E^QÌ7<Ý«B£Ø?j´Õj¸ªsÃÈÝ¤ó^ÃO½Ïôð|/#Ï³Å©z@(I8YFÐ&}¾H³6sLZ¢¼¹JOàÔFØk1îä¼æ}e44ÄÁÁ¬.÷¶hã&jL@H½¡gíÃ°Dák;éèÐ/òìFMSÉºK£yDò&yY'Q¿úözß¿CMj(WhánjJí°¹T`z%Û~Ë¨M;`âp¤´¨&$ÓéÈÿÓ-«É.ä¬Br5L3_í¼/o|«2£ºP^WU=5©ÆgëÏè;l5q³{PYõ¥ÙD½ØÝ±J4ÁßZp$/«dzA^ëÞûECI\"+|±l3oÛÅÉ £¹*¢#P«¡¥Seµò÷¥º¨é*_éEí½oé¾;õàPò]öÀ@OF²Ã¾ÿª jÙÈ=ïÏ¯¡¸Dôýt×0¾ª°Aé¶\ª'·:\8ÀA¡ÿNIO0Uê§ù50¦ç¡vzÝcZ.Ð/±.vÞýÖTÍ0ÍIR/ßkc6o®CÅh+NÍ¤ñ©OZò}òU¿èÓ ,3Ooq¯+@Zºl1\û¼WUª-¥W9Q·ü¹ß²MÊTÆ`>Fè~Æ~ª¦½@ÕÑÒà³çèa²^w8íËüZ4*x`ø@5,;%»)\ìø*Qe44çôÎ×CA¨Kô×^.¼ÕãWå½@\³lÞ^£3údÈK¨çÇ½áD>òèFm"=dËä»å9àVÔÆ½Úc¨kå·¨-Ð:êØ§CÍÕC¤eÉxX}]ß0×^¬`ß}Z|"XVvDû×,zÊ¼'BRÛÝêIúfP{®£ÁUëu%n@üz_tóIwø©¦lh#K wúhZoÌZS¢Óæc©=ÿsY-LÙhQ3ø}¨ñ/C°c^CûÛiÉÏïÜN_ÉdZìes´äd§ELWD6¦}Ð?Å*¹Â?¿ñêwMÎYòI£¥'?%ÄHaZ_LãåÃ¤ë²Þá´/Î¡YhÑ×#ÚUÚ´xºk9,Ñð¾I8ò5R=¢j@Ç&TdØÿñ?ÏÙß±Ë pZr£·âm÷%b'@ÞÍM'ìÿ{ST}ïÁRÆ®àõ_Qé×/K`WÓïØµú×Â$1t/Ú,=Ñ[ôy©ÅRà:R+fÑD®%Ì]Jsæ¾"(âO÷âPK`Ýÿ5o«qG2FIsWä!aÖ;é ¤¢Î6ËÆ[1ª06,*ÈLÅÊ#üáRÃP[º±>×Ç¥;D jü·Æ] ¤myQYNmeõ?;íD|pÙ9á³>*)áÚZÈèMÊxä¡©ÊL!«·}c{_Ø§dôùöÀDQ*pAÉe«»ÈÉ&¨èÈ_G-°Ö £Úsãµ(×÷§«ú)0cèæ¼QÒSá\Ê4xý ½*ÊÔà rßÚ9°~þúfû¯Î¡) ÐB<û0~¢¶TiB(bÇZÓ[A`qG|5þòÆªÍõÍõN²ÿLF6¦©O<ËßOVeWÇ%§4ÖäúÝ@EË²É&¸ÿ´ÀI;ù³´Q$Vr~=Lh%"w^UqÚ,ú)F+ÈßiªÙ#Bº|Þ}5%ÚIø8cF§ÍïYB«Íx1´0èòÝ¹ïÎ°m+FwW¼«´+<9¸d3ÙæÝ.oï[¼k:8Lñµ·[_©2RÈï]Y÷,õ÷Qí¶ñÈ]lhÞâ¼%Ô!æ7JúØ,êòá"³CËùåV'o&eñyÕâ*~ÛrûAê~¥åëTU d¡`oþ{Qb°_Ø°#Ä6°&DzÙá±Eë7xj·Àªe¡o¹Ò£íüØk+®<õÑÜe¥fà«§5¸uçsªþ±x·b1q£AïÀ!Ûÿù¼[[Ë;*a®ñ9õ®zvÆ¬ä¾#73³áû?Wqfñt¿õÉ+Eóm«·Õ½âAxðï´2p_ùÀî8'Àöq:øÉ\!-ýFÈzWnHK0ç1khs='{&4õL8^@£Gß©20M8+0³x¼\Ý¨4ÉBýÈG.H@®Shó4×§ÕºÇü¡acà{!r{-?.¯ð}ÕõySy¨EsÖN÷ürKÁXÌÞ.ì3¹ÈtèÃÁ¢7®ÙXï¾Ji¿_A8X}¦Á%Ë¾M£8W2CðrH1ÍeÖ×!éÍñpFÒþ$EnÅ§KN/Wz¸JªÂ¤Ðeìºaä ^#R²õ1úòR1ÝoT°j¯ØX²ôòà×m^ñÒ²=îy4hù+È\"n?tÓäY=höU¹©a/üqØØ©&@á²/¾qE5ÌÙÇ0>`}Bé§)³ü(´½1TtÎ}§ì´_Waêºü\m?|Ú-DuÚ£a>U·wg»s¡%ÊK»µ ïýo6çs<¤&ä -¤|È£àJÊ§õ1³ô@£×94!ÝÃÀ¶sI¬:Ö#ÕøÂiBcvÂ]UvCQ 9,¸ ^æN´^±^Æ\D{uçÚG,GØÿ&cÝÿæÆ3q¥'fðgÿe÷ÅööÃ:ÓPæÆ¾'BcºO.àè'»èëªz>ÝI"±'·5Æº"Tè×;°Øö±î±]èQM_ÉoèLùJæzÐSÍ)é7ÈlEv²¿oö¼´èQDÙ-ãuÔÉ$©9ò¢¨¼egöCÚ2ç~mAr ÒvññÏ{n|<[Uw$¨&Æ[çóZÔkn_TÙß´0r<Ót5HÄÆK¨(F¤×ÁåK-ü)Póã´~ïÿ?¬úoiÖ>¢£[J=U|¤¦®²7ñÊ(Û,7ÙÖû¬"î¡UÎ1Àãù§d_ª{UQìù2ÔÄûÆä_ûôË4i@¾"BåECàã¸bäú{æ~1ÌªY²ÖàÐAKHò0TFøc2ÛF<ÏYr+©Û|ºk_jê8WÉ«pD4·¥§Ö©¶%<0dÄÌÐÓàm4ßðÐÚ:î-D`dÓ°f´£ù}²ªg8o®foéb1$bP¿$?Bg'©õA:öÿ¶åv=uA½i¤£CóÉü@Y2çxGD´1ÚÛ) nßï!/¾Æj+VøwÃÃ{J=*Q©ôfTôòDÀôðHcÛça_®ÆªZÛä¡FdOåNÑÍØëM1¸kñE6éó®g°-AxäC¼H¦²8>Nê!J£ ©[6êÍLóç"cã^HnÅð¦ÛXkÒ'ìE¿¬,'uÁø&ÃÎ¸ñïûô²fø|TK4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: firefox X-Chunk-Index: 4 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 337 Host: farenaw.cc" with payload::==> "VV&^t4}®GuîjÙoªaÀÅ`áO(ªÂ(ákæ¬F§KB;$%ïbG%O?],>,öù: ÊÂPÌÉËúÕ»(Ã-Íà~ÃçÅl½éZSQ!B;(þýH:Åõ¹:T±À$p?×EI¹fÄ.Z&õüÎð4Gç{ª½VY<)Ï¿Zù¼ÿô@xí`^ÎEú¹)eAu6'újÀÄ¥^ÿL#=C»#þd@M¾¬¤ýk4-ñëÂâ/óÑæ·Æ]}2¥±¸N»M¼JM?È>Ë»¾yÚÓ>:Å û([./às3ºbo[!öªW;¤\Ø±hGÈÛ{Fum>æRê.,¡TÎ¾ÀÙ÷0Ýe'_³ô" HTTP/1.1 200 OK Date: Thu 29 Oct 2026 23:27:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=15 cfOrigin;dur=162 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=a74%2FanGGWTkW9%2BV%2F%2FPQUqxSCjQRoSO6tUKxQBnWTUhBJaq6X3O9noUYZ96uhaa9qZKs98IvTUj8neMrL62R93FZJa8P9DWkagO8vGN1AD6k4KcftrBBN33ThPH0Q"}]} Server: cloudflare CF-RAY: a525f4216fb8f051-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B....... "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: filegraber X-Chunk-Index: 5 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 333 Host: farenaw.cc" with payload::==> "5rÝí¼d¼ëì·ZúI¼ÇÉ´7%LZ,Q_óRÜ~U$ZÙ^AJ8Êij!=YÿÊ%ÇO£Wªòö£Êoo5î`¡Çc¡ËÀüïÝ£ÜÀzÆÇQâÀÖ°hª[Ü$ßÍ¶^õCâedèÞ-y½¤bPêNxá¨Ú4F4B......., "POST /gate/chunk HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Chunk: browsers_agg X-Chunk-Index: 6 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Total: 20 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 1657 Host: farenaw.cc" with payload::==> "^´ýú&¹SÒ&§íÝGÍ\ahmþ¦±ÎPR¾¡}äêòÄÓÅÏÊå®Øá§G_ÿRö\ªÌ°CýFñ#C>JF@^Lo>4ÒR®)iIúÁ~ÜrÍ,¦ïiÇm4m3êÕE¢n»uÚFGÊnT*ôæ´Cµ]Õ+ãýíæÁÎ¤¯ù×qB%3âØa÷ZÎsubëû½Á4Í+æQbGË%ù¯}èû¼»OD1üD_*ó_/ç"A]÷Yx K#=$Ó¸DLK¤²Zøx³ý¥£2ÊûÿY'ãö¼FrÜÂ¹ÊVäuÔ«ØeqøvdöæöºsêùÁýÃ*Cøu0§z}ï}ZÏjÕÕmmÝDíÛJéöÚ&éè&¢âÂ×80m[WQâç?ÒbÚê £UHJü&¼Å+}f¦Ä?¹ëÉ=õ¥ÎrèE]3t¶öíûQ÷b ÊlLfùÈXóVáåf1)Ñk^ª¼îá#®¡¬f^ãÚ6Ý|¿H>eØêz&ó/hè $P_ÊÔér;ÏÿEüÊòñ'õJC@<Ç"ÍÕ%»»ÏZ/¢.Uõø}\pà{l.ºD¹õYîÇ¬°s2»"Äæ1ÎÒWÎÊø_ÆúÐy?ã¶AdP$i¨ÿ-Ð(:=Íëés$)zÒ(KâZ3¬2²¥ßÚ?'¤Í)Ï¶·T7ö©ÓsÙzBÅÆ[ñ~Ö%tEÅ÷/Gór9NÑT¢}Ò¸º¢½2I3Zæ±ÅëÍÁ%$]4W;Ln42&0b¬gVïYo¶Æ[um6¾t+StÀ§wB 6w6á5H.+Ú¦>çÏ¥IÞ uîpï©÷âÙãKeØ3îÕ?Åî¯þ8À¦bc]êÊ+ÉqøÄ|éÕ½÷VL¾2\÷[ZIú¨¯÷SÝ?_Çö±6FuÓ9ÉïîrTr`UvÖxòÍÄ(mZu ãB°ÐÁúpó}E¼!ÿb»j_JÌ,üa±¦óJ¬ÿÌwÞbÐn[@Iqpe_,¡W(&[þþ³ÁÞTN{¨.zTJ.W×Ú[¯qÀØèL! A{[Ù`ÓÂÝÇ>ÍDhðöQøõêÏÚ=`?Ü@ÿjÃÊÜ.vrât=]ô]Ä°PäêÕfMóÛKÍýíÉ¡¢."kRLÆ0\*G¡ñUK<áB£&&IØRc{-íYõ:>Z±8ßI&aAw`þW·G·½¯Þ4æ$N¤=oéT¡,|(ÆÀFûgÃCj²»A<÷ÍpíàÍ|´"mÊìç¤oå°)+.¿)ÀªõäßÒvhÕé½JFÒò8ÔAÏ{EêýLU«Õfèò^ØáÆl¶Ìf ua³Öíu×4ø¡0H´Ä=ÛÍú«Q!ç8·aGhr«Å÷¢îW¼îñÿÊS":Q#RÄÉïF«ûÚÒÖ?ë§ãÇÝN|(Ãþúß`þ¹)Ö³§«ù=3\a¸¿¿°| äø_²|ÍQ3áJÁ±]8Ã)O½_G9z´3Ñß2#Ö#î\»;ûøg`ÃÆßÏ]8Ién#EÕg<¯"eþ:iû)À;64F4B......., "POST /gate/complete HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Microsoft-CryptoAPI/10.0 X-Build-ID: 5e6f0b52 X-HWID: 8913A231 X-Session: 3325c08bd40b9a1db7a6b9b868c0ce13 X-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963 Content-Length: 8 Host: farenaw.cc" with payload::==> "COMPLETE" HTTP/1.1 200 OK Date: Thu, 29 Oct 2026 23:27:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=9,cfOrigin;dur=471 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bCZQycZpQhKJjxkBo7%2FqpSgGjpBGmDzovrDM7GZE1GRQy3R%2FkcVJAW8fCTnd11uS2E0CgYpE84vYi3FH0X6%2FKPHxq%2Fuy6hTY%2Be4aMN5JP%2B%2FUKdi7MNFGO5oheCqj"}]} Server: cloudflare CF-RAY: a525f4273f43f051-SJC alt-svc: h3=":443"; ma=86400 with response body ==>4F4B.......57:T98c,"glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF6a16.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF11b5.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF685c.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d185_1.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d185_1.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d185_2.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d185_2.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d194_3.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d194_3.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d1a4_4.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d1a4_4.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d1b4_5.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40d1b4_5.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40db75_6.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40db75_6.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40db84_7.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40db84_7.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dc85_8.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dc85_8.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dca4_9.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dca4_9.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dcb4_a.tmp-wal" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_40dcb4_a.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\~DF6c20.tmp" with delete access "glaicer.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\akg_ff_40e3af.tmp" with delete access58:Tb16,"glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "glaicer.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")59:Tbb7,"glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1752) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1752) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1744) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1744) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1796) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1796) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1800) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1800) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1804) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1804) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1808) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1808) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1772) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1772) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1712) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\taskkill.exe" (Handle: 1712) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1800) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1800) "glaicer.exe" wrote 00003600 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1800) "glaicer.exe" wrote 00000010 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1800) "glaicer.exe" wrote 00000338 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 1800) "glaicer.exe" wrote 000011C0 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1804) "glaicer.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1804) "glaicer.exe" wrote 00003600 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1804) "glaicer.exe" wrote 00000010 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1804) "glaicer.exe" wrote 00000338 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 1804)5a:T71e,"glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-wal"5b:T143d,"glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History-wal" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\pkcs11.txt" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cert9.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\key4.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\logins.json" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\pkcs11.txt" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\logins.json" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\key4.db" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FlashFXP\Sites.dat" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log" "glaicer.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000005.ldb" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies-wal" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data" "glaicer.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data-wal"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1793316567054,"unified_at":"2026-10-29T23:29:27.054Z","metadata":{"hashes":{"sha256":"c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","sha1":"9f7ddeb64d87b4682fdca71fa35ac6e77d2a4e09","md5":"fa7f4daf13d59f593c14b482d416538a","sha512":"ef23528f6dfc2132f11cfb236c7a78016f96e410f7dc6a6a27c04e9845772e93a57779ad989b60ecc65aaaf98f258d14230630807db142047011e4baddbbdb02","ssdeep":"24576:A7VlAftU1CARNzz+5rjflBE8zNNg2CV3+olWfjGdVPfHsnSGsDh9jTAUdZ5wsbKU:A73AfPALzi5hzs2sOoaj8HGuOs+k","ssdeep_chunks":["24576:A7VlAft","24576:7VlAftU","24576:VlAftU1","24576:lAftU1C","24576:AftU1CA","24576:ftU1CAR","24576:tU1CARN","24576:U1CARNz","24576:1CARNzz","24576:CARNzz+","24576:ARNzz+5","24576:RNzz+5r","24576:Nzz+5rj","24576:zz+5rjf","24576:z+5rjfl","24576:+5rjflB","24576:5rjflBE","24576:rjflBE8","24576:jflBE8z","24576:flBE8zN","24576:lBE8zNN","24576:BE8zNNg","24576:E8zNNg2","24576:8zNNg2C","24576:zNNg2CV","24576:NNg2CV3","24576:Ng2CV3+","24576:g2CV3+o","24576:2CV3+ol","24576:CV3+olW","24576:V3+olWf","24576:3+olWfj","24576:+olWfjG","24576:olWfjGd","24576:lWfjGdV","24576:WfjGdVP","24576:fjGdVPf","24576:jGdVPfH","24576:GdVPfHs","24576:dVPfHsn","24576:VPfHsnS","24576:PfHsnSG","24576:fHsnSGs","24576:HsnSGsD","24576:snSGsDh","24576:nSGsDh9","24576:SGsDh9j","24576:GsDh9jT","24576:sDh9jTA","24576:Dh9jTAU","24576:h9jTAUd","24576:9jTAUdZ","24576:jTAUdZ5","24576:TAUdZ5w","24576:AUdZ5ws","24576:UdZ5wsb","24576:dZ5wsbK","24576:Z5wsbKU","49152:A7VlAft","49152:7VlAftU","49152:VlAftU1","49152:lAftU1C","49152:AftU1CA","49152:ftU1CAR","49152:tU1CARN","49152:U1CARNz","49152:1CARNzz","49152:CARNzz+","49152:ARNzz+5","49152:RNzz+5r","49152:Nzz+5rj","49152:zz+5rjf","49152:z+5rjfl","49152:+5rjflB","49152:5rjflBE","49152:rjflBE8","49152:jflBE8z","49152:flBE8zN","49152:lBE8zNN","49152:BE8zNNg","49152:E8zNNg2","49152:8zNNg2C","49152:zNNg2CV","49152:NNg2CV3","49152:Ng2CV3+","49152:g2CV3+o","49152:2CV3+ol","49152:CV3+olW","49152:V3+olWf","49152:3+olWfj","49152:+olWfjG","49152:olWfjGd","49152:lWfjGdV","49152:WfjGdVP","49152:fjGdVPf","49152:jGdVPfH","49152:GdVPfHs","49152:dVPfHsn","49152:VPfHsnS","49152:PfHsnSG","49152:fHsnSGs","49152:HsnSGsD","49152:snSGsDh","49152:nSGsDh9","49152:SGsDh9j","49152:GsDh9jT","49152:sDh9jTA","49152:Dh9jTAU","49152:h9jTAUd","49152:9jTAUdZ","49152:jTAUdZ5","49152:TAUdZ5w","49152:AUdZ5ws","49152:UdZ5wsb","49152:dZ5wsbK","49152:Z5wsbKU","24576:A73AfPA","24576:73AfPAL","24576:3AfPALz","24576:AfPALzi","24576:fPALzi5","24576:PALzi5h","24576:ALzi5hz","24576:Lzi5hzs","24576:zi5hzs2","24576:i5hzs2s","24576:5hzs2sO","24576:hzs2sOo","24576:zs2sOoa","24576:s2sOoaj","24576:2sOoaj8","24576:sOoaj8H","24576:Ooaj8HG","24576:oaj8HGu","24576:aj8HGuO","24576:j8HGuOs","24576:8HGuOs+","24576:HGuOs+k"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"glaicer.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3460472,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793312429000,"last_seen":1793316435000,"last_multi_scan":1793316435000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["aokigaharastealer","criminal","informationstealer","new_domain","malicious","evasive","infostealer"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":96},"sandbox_signatures":{"informative_count":226,"suspicious_count":14,"malicious_count":17,"total":257},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Contains AI service credential strings"},{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"malicious","value":"Attempts to stop multiple expected running processes on the machine"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Able to perform anti-VM checks using CPUID"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Observed security product related strings in binary/memory"},{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to detect sandbox environment via user account"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Able to identify virtual environment using sandbox registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Run Virtual Instance","attack_id":"T1564.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/006","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"internal/chacha8rand\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"*chacha8rand.State\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"chacha8\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"encoding/base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"*base64.Encoding\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\t*xml.name\", Heuristic match: \"*godebugs.info\", Heuristic match: \"*[]xml.name\", Heuristic match: \"\t*abi.name\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"\nSetsockoptInt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileType\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"Software\\Valve\\Steam\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"Software\\Valve\\Steam\\Users\" (Indicator: \"software\\valve\\steam\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"%s\\config\\loginusers.vdf\" (Indicator: \"config\\loginusers.vdf\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"glaicer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"glaicer.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"glaicer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenService\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RAes\\lr\" (Indicator: \"Aes\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"HMAC\"; File: \"akg_40dcb4_a.tmp\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"glaicer.exe\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Oid\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp\")\n Found reference to \"RAes\\lr\" (Indicator: \"Aes\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006116.00000000.212194.40000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 44E00000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"glaicer.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"glaicer.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"taskkill.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n 02h in Stream UID: 11075-5710-0044E6FC\n Assembly shows XOR instruction xor eax\n 02h in Stream UID: 11075-5710-0044E6FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\Mozilla Firefox\\softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00006116-00000C2B-2295328695\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00006116-00000C66-2295373801\")\n Found string \"%PROGRAMFILES%\\Mozilla Firefox\\freebl3.dll\" (Indicator: \"\\freebl3.dll\"; Source: \"00000000-00006116-00000C2B-2295381462\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"akg_40dcb4_a.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_40dc85_8.tmp\")\n file/memory contains long string with (Indicator: \"youtube.com\"; File: \"akg_40d194_3.tmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"Found string \"WDAGUtilityAccount\" (Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"::GetUserNameW\" (Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"BIOSVersion\" (Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"OSVersionInformation\" (Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string(Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using sandbox registry","description":"Found string \"SOFTWARE\\VMware, Inc.\\VMware Tools\" (Indicator: \"software\\vmware, inc.\\vmware tools\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Indicator: \"software\\oracle\\virtualbox guest additions\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters\" (Indicator: \"software\\microsoft\\virtual machine\\guest\\parameters\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-668","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\vmci\" (Indicator: \"\\vmci\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform anti-VM checks using CPUID","description":"Found string \"KVMKVMKVM\" (Indicator: \"kvmkvmkvm\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":3,"id":"string-674","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"glaicer.exe\")\n Found string \", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket\tWeight\tShare------\t------\t-----Rounding drift\t\t%d\" (Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$32","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"glaicer.exe\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"glaicer.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"glaicer.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"glaicer.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"glaicer.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"glaicer.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"glaicer.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"glaicer.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"glaicer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"glaicer.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"glaicer.exe\" called \"GetWindowTextA\" with parameter \"Program Manager\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"glaicer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"glaicer.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"glaicer.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"glaicer.exe\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"GetVersion\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"glaicer.exe\" queried token user identity (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2285779653\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2285785472\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2288270894\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2295634839\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2295985253\n \"glaicer.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006116-00000C17-2296673375","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$35","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"glaicer.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"glaicer.exe\"\n Found registry modification API: \"RegCreateKey (in long string)\" in \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n Found reference to API \", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket\tWeight\tShare------\t------\t-----Rounding drift\t\t%d\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"glaicer.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n file/memory contains long string(Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"glaicer.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft (UID: 00000000-00006116)\n \"glaicer.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\Microsoft\\Vault (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"glaicer.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_deed73b0_17e4\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00006116)\n \"glaicer.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\akg_deed6f0d_17e4\"\n dwOpenMode: \"1\"\n dwPipeMode: \"0\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"glaicer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_deed73b0_17e4\" - (UID: 00000000-00006116)\n \"glaicer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\akg_deed6f0d_17e4\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"farenaw.cc\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.38.216:443\"\n \"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"glaicer.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"glaicer.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"glaicer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"glaicer.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"glaicer.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"glaicer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"glaicer.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3b","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"glaicer.exe\" failed to load missing module \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release/nssckbi.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"glaicer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"r@uma.negativesamples.reason\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT %lu.%lu; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\akg_deed73b0_17e4\n Found string - \\\\.\\pipe\\akg_deed6f0d_17e4\n Found string - \\\\.\\pipe\\akg_%lx_%lx","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https_discordapp.com_0\" (Indicator: \"discordapp.com\")\n \"discordapp.com\" (Indicator: \"discordapp.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\" Response ==> HTTP/1.1 200 OK\nDate: Thu\n 29 Oct 2026 23:27:46 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 88\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553222C2263697479223A2253616E746120436C617261222C22697370223A225A61796F2042616E647769647468222C.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00002240)\n Launches browser \"msedge.exe\" (UID: 00000000-00004396)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 42680000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"glaicer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 4FC10000\n \"glaicer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 4F230000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 4FC10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"glaicer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 504E0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 504E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"glaicer.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"glaicer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"glaicer.exe\" has an writable section named \".data\"\n \"glaicer.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"glaicer.exe\" file has an entrypoint instructions - \"jmp\t0x46e4a0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1be600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x14fa00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1be571\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x14f870\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" [Source: 00000000-00006116-00000BC0-2289708599]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\taskkill.exe\" [Source: 00000000-00006116-00000BC0-2289711499]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"taskkill.exe\" (UID: 00000000-00006376) was launched with new environment variables: \"USERDNSDOMAIN=\"4u4Fii6tveqAyyc\"\"\n Process \"taskkill.exe\" (UID: 00000000-00006376) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"farenaw.cc\"\n \"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"glaicer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 457737)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$40","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"glaicer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\akg_debug.txt\"\n \"glaicer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\~DF6a16.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"glaicer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$41","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"glaicer.exe\" queries basic process information of the \"C:\\glaicer.exe\" (UID: 6116)\n \"glaicer.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 6116)\n \"glaicer.exe\" queries basic process information of the \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (UID: 6116)\n \"glaicer.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 6116)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 6376)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 6416)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 7244)\n \"taskkill.exe\" queries basic process information of the \"C:\\Windows\\System32\\taskkill.exe\" (UID: 1548)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data for account\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\network\\cookies\"\n \"glaicer.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\web data\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$45","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"glaicer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\glaicer.exe\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"glaicer.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\MSVCP140.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSVCP140.dll\"\n \"glaicer.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"glaicer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\akg_debug.txt\"\n \"glaicer.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\~df6a16.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"glaicer.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp, 00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp, 00000000-00004396.00000000.212812.1D87F000.00000002.mdmp\")\n Found reference to API \", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket\tWeight\tShare------\t------\t-----Rounding drift\t\t%d\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$48","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c02a940\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c060550\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c0801c0\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c0dd2a0\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c07ca40\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c06b980\"\n \"lpReserved\": \"0\"}\n \"glaicer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1e99c02c960\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /gate/handshake\"\n Found http requests in header \"GET /json/?fields=query,countryCode,city,isp\"\n Found http requests in header \"POST /gate/chunk\"\n Found http requests in header \"POST /gate/complete\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"glaicer.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; Source: \"00000000-00002240.00000000.212750.84B43000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"akg_40dcb4_a.tmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n Potential IP \"0.0.0.0\" found in string \"0.0.0.0-devel\"\n \"0.0.0.0\"\n \"0.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/?fields=query\ncountryCode\ncity\nisp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"farenaw.cc\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://farenaw.cc/gate/handshake\n Found HTTPS POST request to https://farenaw.cc/gate/chunk\n Found HTTPS POST request to https://farenaw.cc/gate/complete","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"farenaw.cc\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.38.216\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"FTP/WinSCP/Sessions.txt\" (Indicator: \"winscp\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"akg_40db75_6.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_40db84_7.tmp\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"akg_40d185_1.tmp\")\n Found string \"%s\\1password\\data\" (Indicator: \"1password\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00002240.00000000.212750.1D12D000.00000002.mdmp\")\n Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00004396.00000000.212812.1CEA1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"glaicer.exe\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"glaicer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"glaicer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"glaicer.exe\" called \"GetComputerNameA\" (UID: 00000000-00006116)\n \"glaicer.exe\" called \"GetComputerNameW\" (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"glaicer.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains AI service credential strings","description":"Found string \"%s\\.codex\\auth.json\" (Indicator: \".codex\\auth.json\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"%s\\.codex\\config.toml\" (Indicator: \".codex\\config.toml\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":3,"id":"string-1001","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n Found reference to API \"syscall.procGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")\n Found reference to API \", locked to threadruntime.semacreateruntime.semawakeupGetSidSubAuthorityQueryServiceStatusGetComputerNameExWuse of closed filex509negativeserialRtlAddFunctionTableGetCurrentProcessIdBucket\tWeight\tShare------\t------\t-----Rounding drift\t\t%d\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")\n Found reference to API \"internal/syscall/windows.procGetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"glaicer.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26594000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006116-00000C2D-31100111008\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"%s\\1password\\data\" (Indicator: \"password\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"Mails/Thunderbird/passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\%s\\Outlook\\Profiles\\%s\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00006116.00000000.212194.00180000.00000004.mdmp\n 00000000-00006116.00000000.212194.40000000.00000040.mdmp\n 00000000-00006116.00000001.212788.40000000.00000040.mdmp\n \"%s\\Thunderbird\\Profiles\" in Source: 00000000-00006116.00000000.212194.00180000.00000004.mdmp\n 00000000-00006116.00000000.212194.40000000.00000040.mdmp\n 00000000-00006116.00000001.212788.40000000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00006116.00000000.212194.00180000.00000004.mdmp\n 00000000-00006116.00000000.212194.40000000.00000040.mdmp\n 00000000-00006116.00000001.212788.40000000.00000040.mdmp\n \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00006116.00000000.212194.00180000.00000004.mdmp\n 00000000-00006116.00000000.212194.40000000.00000040.mdmp\n 00000000-00006116.00000001.212788.40000000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Vault\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006116-00000C3E-31777496778\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"glaicer.exe\")\n Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"route\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Observed security product related strings in binary/memory","description":"Found string -csfalconservice.exe\n Found string -CrowdStrike Falcon","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-123","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"%s\\logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"Browser/%s/%s/logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"%s\\key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n Found string \"Browser/%s/%s/key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/Connections.txt\" (Indicator: \"connections.txt\")\n \"%s\\SmartFTP\\Client 2.0\\Favorites\" (Indicator: \"\\smartftp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"AISessions/AWS/credentials\" (Indicator: \"aws/credentials\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"glaicer.exe\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"glaicer.exe\"\n Found registry deletion API: \"RegDeleteKey (in long string)\" in \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006116-00000BC0-2289708599\")\n Found string \"\\Device\\HarddiskVolume3\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006116-00000BC0-2291899359\")\n Found string \"\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006116-00000BC0-2292859521\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"glaicer.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"glaicer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"eByHandleWGetQueuedCompletionStatusUpdateProcThreadAttributereflect: Bits of nil Type2910383045673370361328125goroutine profile cleanupchansend: spurious wakeupruntime\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"glaicer.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.26594000.00000002.mdmp, 00000000-00006116.00000001.212788.26A27000.00000002.mdmp, 00000000-00006116.00000001.212788.2A13B000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"glaicer.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006116.00000000.212194.00180000.00000004.mdmp, 00000000-00006116.00000000.212194.40000000.00000040.mdmp, 00000000-00006116.00000001.212788.1CAE4000.00000002.mdmp, 00000000-00006116.00000001.212788.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"glaicer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"BE636B7D0068DD010000000000000000000000000200000000\")\n \"glaicer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"$54","origin":"File/Memory","mitre_attack_id":"T1685","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"glaicer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"glaicer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES\\GOOGLE\\CHROME\\APPLICATION\\CHROME.EXE\"; Value: \"BE636B7D0068DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"glaicer.exe\")\n file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00006116.00000000.212194.010E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"ungetc\" (Source: glaicer.exe, API is part of module: MSVCRT.DLL)\n Found string \"accept\" (Source: glaicer.exe, API is part of module: WS2_32.DLL)\n Found string \"remove\" (Source: glaicer.exe, API is part of module: MSVCRT.DLL)\n Found string \"WSAIoctl\" (Source: glaicer.exe, API is part of module: WS2_32.DLL)\n Found string \"GetFileType\" (Source: glaicer.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: glaicer.exe, API is part of module: KERNELBASE.DLL)\n Found string \"timeEndPeriod\" (Source: glaicer.exe, API is part of module: KERNEL32.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: glaicer.exe, API is part of module: NTDLL.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"glaicer.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00006116-00000BC0-2289708599\")\n Found string \"%WINDIR%\\SYSTEM32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00006116-00000BC0-2289711499\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"\"glaicer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ORACLE VM VIRTUALBOX GUEST ADDITIONS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$56","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"glaicer.exe\" reads file \"C:\\Windows\\system.ini\"\n \"glaicer.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.38.216 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$57","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetUserNameA@ADVAPI32.DLL\" in \"glaicer.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$58","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n LoadLibraryW\n GetProcAddress\n CreateThread\n LoadLibraryExW\n GetSystemDirectoryA\n GetSystemInfo\n WriteFile\n GetThreadContext","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"glaicer.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to stop multiple expected running processes on the machine","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00001052)\n Process \"chrome.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00002240)\n Process \"msedge.exe\" with commandline \"--no-startup-window --headless\" (UID: 00000000-00004396)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-604","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"glaicer.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"1800\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"1858167837072\"\n \"lpParameter\": \"1858167846400\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}\n \"glaicer.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"1804\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"1519067468176\"\n \"lpParameter\": \"1519067477504\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"glaicer.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window --headless\" - (UID: 00000000-00006116)\n \"glaicer.exe\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --headless\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00006376)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00006416)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00007244)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00001548)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00004168)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00007180)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00005032)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00001052)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The signature of the certificate cannot be verified. (0x80096004)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$59","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"farenaw.cc\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"farenaw.cc\" (2 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on process \"00000000-00006116\"","origin":"YARA Signature","relevance":10,"id":"yara-8","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$5a","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"\"glaicer.exe\" called \"CredEnumerateA\" with parameters {\"Filter\": \"TERMSRV/*\"\n \"Flags\": \"0\"\n \"Count\": \"00000000\"\n \"Credential\": \"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\"}","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\16.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK\\9375CFF0413111D3B88A00104B2A6676\")\n \"glaicer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\15.0\\OUTLOOK\\PROFILES\\OUTLOOK 2\\9375CFF0413111D3B88A00104B2A6676\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"glaicer.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$5b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"glaicer.exe\" (UID: 00000000-00006116)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe\" (UID: 00000000-00006376)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM brave.exe\" (UID: 00000000-00006416)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe\" (UID: 00000000-00007244)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM opera.exe\" (UID: 00000000-00001548)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM browser.exe\" (UID: 00000000-00004168)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM vivaldi.exe\" (UID: 00000000-00007180)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM firefox.exe\" (UID: 00000000-00005032)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM yandex.exe\" (UID: 00000000-00001052)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"intel_graph":{"map":{"Domain:farenaw.cc":{"type":"Domain","value":"farenaw.cc"},"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b":{"type":"File","value":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c":{"type":"File","value":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247":{"type":"File","value":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3":{"type":"File","value":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},"File:5bfe1fb08f3adb294f66023844e7859a33e2826ca628c850a2ef18039f9189b3":{"type":"File","value":"5bfe1fb08f3adb294f66023844e7859a33e2826ca628c850a2ef18039f9189b3"},"File:718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881":{"type":"File","value":"718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c":{"type":"File","value":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af":{"type":"File","value":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc":{"type":"File","value":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314":{"type":"File","value":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532":{"type":"File","value":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024":{"type":"File","value":"c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","filetype":"PE32+ executable for MS Windows 6.01 (GUI), x86-64, 8 sections","filetype_short":"PE64"},"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813":{"type":"File","value":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},"File:d8652301ab712a29525b8b94137dc76f2c8563e9de187c0656d76b6ad4526595":{"type":"File","value":"d8652301ab712a29525b8b94137dc76f2c8563e9de187c0656d76b6ad4526595"},"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5":{"type":"File","value":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},"Ip:104.21.38.216":{"type":"Ip","value":"104.21.38.216"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Url:/gate/chunk":{"type":"Url","value":"/gate/chunk"},"Url:/gate/complete":{"type":"Url","value":"/gate/complete"},"Url:/gate/handshake":{"type":"Url","value":"/gate/handshake"},"Url:/json/?fields=query,countryCode,city,isp":{"type":"Url","value":"/json/?fields=query,countryCode,city,isp"}},"chains":[{"id":"1565507391994650035","root":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","edges":[{"edge_kind":"contacted_ip","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Ip:104.21.38.216"},{"edge_kind":"contacted_ip","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Domain:farenaw.cc"},{"edge_kind":"resolves_to","from_key":"Domain:farenaw.cc","to_key":"Ip:104.21.38.216"},{"edge_kind":"contacted_domain","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_url","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Url:/gate/handshake"},{"edge_kind":"contacted_url","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Url:/json/?fields=query,countryCode,city,isp"},{"edge_kind":"contacted_url","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Url:/gate/chunk"},{"edge_kind":"contacted_url","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"Url:/gate/complete"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","edges":[{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:d8652301ab712a29525b8b94137dc76f2c8563e9de187c0656d76b6ad4526595"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b"},{"edge_kind":"extracted","from_key":"File:c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","to_key":"File:5bfe1fb08f3adb294f66023844e7859a33e2826ca628c850a2ef18039f9189b3"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":45,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["aokigaharastealer","criminal","informationstealer","new_domain","malicious","evasive","infostealer"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ae3d652ef0f240b9c06dbd7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"glaicer.exe","analysis_start_time":"2026-10-29T23:27:15+00:00","indicators_count":{"informative":226,"suspicious":65,"malicious":18},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.38.216","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"dns_resolutions":[{"domain":"farenaw.cc","address":"104.21.38.216","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"http_requests":[{"host":"farenaw.cc","host_ip":"104.21.38.216:443","url":"/gate/handshake","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/handshake HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 5e6f0b52\nX-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963\nX-Session: 3325c08bd40b9a1db7a6b9b868c0ce13\nX-HWID: 8913A231\nX-KEX: x25519\nContent-Length: 32\nHost: farenaw.cc","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=query,countryCode,city,isp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=query,countryCode,city,isp HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0\nHost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"host":"farenaw.cc","host_ip":"104.21.38.216:443","url":"/gate/chunk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/chunk HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 5e6f0b52\nX-HWID: 8913A231\nX-Chunk: sysinfo\nX-Chunk-Index: 0\nX-Session: 3325c08bd40b9a1db7a6b9b868c0ce13\nX-Total: 20\nX-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963\nContent-Length: 3007\nHost: farenaw.cc","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"host":"farenaw.cc","host_ip":"104.21.38.216:443","url":"/gate/complete","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gate/complete HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Microsoft-CryptoAPI/10.0\nX-Build-ID: 5e6f0b52\nX-HWID: 8913A231\nX-Session: 3325c08bd40b9a1db7a6b9b868c0ce13\nX-Gate-Token: f20c1f69da981133255e179c532b1180e06346e998d5942a7b88bd16253a5963\nContent-Length: 8\nHost: farenaw.cc","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}],"processes":[{"pid":6116,"ppid":0,"name":"glaicer.exe","command_line":"","sha256":"c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024","normalized_path":"C:\\glaicer.exe","uid":"00000000-00006116","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":6376,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM chrome.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00006376"},{"pid":6416,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM brave.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00006416"},{"pid":7244,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM msedge.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00007244"},{"pid":1548,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM opera.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00001548"},{"pid":4168,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM browser.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00004168"},{"pid":7180,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM vivaldi.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00007180"},{"pid":5032,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM firefox.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00005032"},{"pid":1052,"ppid":6116,"name":"taskkill.exe","command_line":"taskkill /F /IM yandex.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\SYSTEM32\\taskkill.exe","parent_uid":"00000000-00006116","uid":"00000000-00001052"},{"pid":2240,"ppid":6116,"name":"chrome.exe","command_line":"--no-startup-window --headless","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006116","uid":"00000000-00002240"},{"pid":4396,"ppid":6116,"name":"msedge.exe","command_line":"--no-startup-window --headless","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006116","uid":"00000000-00004396"}],"all_imported_dlls":["wbemprox.dll","kernel32.dll","gdi32full.dll","vcruntime140_1.dll","cryptsp.dll","framedynos.dll","imm32.dll","OnDemandConnRouteHelper.dll","IPHLPAPI.DLL","msasn1.dll","WindowsCodecs.dll","mozglue.dll","wbemcomn.dll","profapi.dll","KernelBase.dll","fltLib.dll","FWPUCLNT.DLL","ncryptsslp.dll","fastprox.dll","win32u.dll","gdi32.dll","msvcp140.dll","shlwapi.dll","ntasn1.dll","GdiPlus.dll","kernel.appcore.dll","dbghelp.dll","apphelp.dll","user32.dll","combase.dll","cryptbase.dll","msctf.dll","mpr.dll","wbemsvc.dll","vcruntime140.dll","ole32.dll","rasadhlp.dll","crypt32.dll","nss3.dll","VxSSL64.dll","rsaenh.dll","winsta.dll","ws2_32.dll","ucrtbase.dll","sspicli.dll","gpapi.dll","freebl3.dll","srvcli.dll","clbcatq.dll","msvcp_win.dll","winhttp.dll","softokn3.dll","sxs.dll","umpdc.dll","winnsi.dll","nsi.dll","wsock32.dll","userenv.dll","msedge_elf.dll","ntdll.dll","msvcrt.dll","oleaut32.dll","webio.dll","dnsapi.dll","uxtheme.dll","netutils.dll","amsi.dll","MpOAV.dll","AOIUNU6c.dll","chrome_elf.dll","powrprof.dll","schannel.dll","rpcrt4.dll","bcryptprimitives.dll","bcrypt.dll","mswsock.dll","ncrypt.dll","dpapi.dll","version.dll","advapi32.dll","sechost.dll","AcLayers.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881","sha256":"718d054d879089d33ff11ed4a45214575a3cc13c44469bec48970acd6b9e0881","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"akg_40d185_2.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40d185_1.tmp","sha256":"d286c7aa59052c28a12e65c92aaf67b371b4006c9606c1bb9e1e2ec12db31813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40d194_3.tmp","sha256":"8b6115570ff44acf6b0f3ad303c95a59123f3190624b83aadfb450122f0f46cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40d1a4_4.tmp","sha256":"52de55223b143a2b84bcd9877c7fd130e9b38d0723c755d024d9d85488c2b7b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40d1b4_5.tmp","sha256":"e2aff78aecb13f44069b96909885f3c4c7a6b202408f41160741a2f6fdbce3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40db75_6.tmp","sha256":"7981ac3fbef53f433da1c1a2521e8d593fcfc5b67297e16a82a1c59b3c3719af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40db84_7.tmp","sha256":"1da3dc6847c1990755bc940af3eed0d7fc6eca48297c9f8032fce8aeebf8c247","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40dc85_8.tmp","sha256":"98fbc6a16f5ba6b4d6c9055e287600c86f142008aeef44d1c4a20cac8a790314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40dca4_9.tmp","sha256":"09476c4b800a057e79a2cc4cd9326987840438ef7cb05ee6e3a32d50148e2e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_40dcb4_a.tmp","sha256":"770f1f46637f5e9ff091f631f999d1453764eaccffccea3ccb8590c79fee964c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_debug.txt","sha256":"d8652301ab712a29525b8b94137dc76f2c8563e9de187c0656d76b6ad4526595","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"akg_ff_40e3af.tmp","sha256":"bf5c7a4b553425057e22a5205fb420fb591f802357362cb0db7efeec7c3d6532","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"~DF11b5.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"~DF685c.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"~DF6a16.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"~DF6c20.tmp","sha256":"06cd083f117ce94bc3cf55753b6ccd8d435c817b042f9456eb9af49be9a09e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"test_output.zip","sha256":"5bfe1fb08f3adb294f66023844e7859a33e2826ca628c850a2ef18039f9189b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_debug.txt","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\~DF6a16.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\~DF11b5.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\~DF685c.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40d185_1.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40d185_2.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40d194_3.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40d1a4_4.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40d1b4_5.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40db75_6.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40db84_7.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40dc85_8.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40dca4_9.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_40dcb4_a.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\akg_ff_40e3af.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%TEMP%\\~DF6c20.tmp","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"%APPDATA%\\Microsoft\\Vault","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"C:\\test_output.zip","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"pipe\\akg_deed73b0_17e4","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"path":"pipe\\akg_deed6f0d_17e4","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"key":"HKCUHKCU\\SOFTWARE\\GOOGLE\\CHROME\\THIRDPARTY\\\\","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\BaseNamedObjects\\a0e9c726","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:6116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:6116:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:6376:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:6416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:6416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:7244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:7244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:1548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:1548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:4168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:4168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:7180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:5032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:5032:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:1052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"Local\\SM0:4396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:4396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"SM0:4396:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae3d652ef0f240b9c06dbd7"}]}]}},"report_ids":{"sandbox_job_ids":["6ae3d652ef0f240b9c06dbd7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample c5ec4c1fb44c… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c5ec4c1fb44c…. Malware family: Win/malicious_confidence_60%. Threat score 85/100. 1/27 AV engines flagged this file. 17 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample c5ec4c1fb44c… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c5ec4c1fb44c…. Malware family: Win/malicious_confidence_60%. Threat score 85/100. 1/27 AV engines flagged this file. 17 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c5ec4c1fb44cf43c926f7430411085e97d6f71d0cae7c1e3defced383ab09024"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample c5ec4c1fb44c… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c5ec4c1fb44c…. Malware family: Win/malicious_confidence_60%. Threat score 85/100. 1/27 AV engines flagged this file. 17 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5c","11",{}]]