24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 90177d07a806… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 90177d07a806…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 9/27 AV engines flagged this file. 9 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284"],"about":{"@type":"SoftwareApplication","name":"90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c2,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "[ERROR] NtMapViewOfSection failed, status:" (Indicator: "NtMapViewOfSection"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp")26:T842,Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp")27:T8c2,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp")28:T6aa," HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: MISS CF-RAY: 9fc93248c8027b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:35 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 22 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932d6ffb87b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:36 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 23 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932df6bef7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:36 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 23 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932e22fc47b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:37 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 24 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932e7f88d7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:38 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 25 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932ee0a3d7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:39 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 26 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932f299be7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:40 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 27 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932f84b827b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:41 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 28 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc932ff2f037b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:42 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 29 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc933051fd97b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:43 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 30 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9330c1a017b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:45 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 31 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc933145e757b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:46 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 33 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9331af87a7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:47 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 33 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc93320c9057b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 34 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc93326f9627b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 35 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9332c590c7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:49 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 36 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9333299a37b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:51 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 38 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc93339ec887b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:51 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 38 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9333edbe47b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 39 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc93342f9c47b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 39 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc93345fdc57b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:53 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 40 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc933493a6d7b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:53 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 40 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9334c5ed87b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:54 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 41 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9334f5b947b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A....... "GET /raw/DJmUDd9A HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP/1.0 Host: pastebin.com" Response ==> HTTP/1.1 200 OK Date: Sat 16 May 2026 09:01:54 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block Cache-Control: public max-age=14400 Age: 41 last-modified: Sat 16 May 2026 09:01:13 GMT cf-cache-status: HIT CF-RAY: 9fc9335298007b83-SJC with response body ==>7B0D0A2020202022656E61626C655F637075223A20312C0D0A2020202022656E61626C655F677075223A20312C0D0A20202020226370755F636F6E666967223A.......33:T910,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://127.0.0.1:8080/api/updates/current--donate-level" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://127.0.0.1:8080/api/updates/current%ory08>=i@iqoz" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!423836,912,68aeeepqqqqqqqqqqqqqqqq80," - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microod?shreq@d,0reqlhreshprs" - Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp") Found URL "https://pastebin.com/raw/djmudd9a:\windows\system32\ondemandconnroutehelper.dllwindows" - Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found URL "https://pastebin.com/raw/djmudd9ahttps://pastebin.com/raw/djmudd9ahttps://pastebin.com/raw/djmudd9attps://pastebin.com/raw/djmudd9a-donate-level" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://127.0.0.1:8888/2/summaryhttp://127.0.0.1:8888/pastebin.com/pastebin.comwu\0digicert" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://127.0.0.1:8080nu2.4o0-%i1$jd" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp")3f:T413,Found string "inHTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00000336.00000000.287938.2DCD0000.00000004.mdmp, 00000000-00000336.00000000.287938.302C0000.00000004.mdmp, 00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp, 00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found string "WinHTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00000336.00000000.287938.2DCD0000.00000004.mdmp, 00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000336.00000000.287938.302C0000.00000004.mdmp, 00000000-00000336.00000001.289858.302C0000.00000004.mdmp") Found string "GET /raw/DJmUDd9A HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found string "User-Agent: WinHTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found string "dHTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000336.00000001.289858.302C0000.00000004.mdmp")40:T72d,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00000336.00000000.287938.2DCD0000.00000004.mdmp, 00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "83529988985,912,3124,,Process32NextW,kernel32.dll,"01:15:29.000",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00000336.00000001.289858.2DCD0000.00000004.mdmp")41:T42a,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "90177d07a8065e45db20992ff869f755885445ee5a950e41c170d3c43aa30284.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000336.00000000.287938.E8562000.00000004.mdmp, 00000000-00000336.00000001.289858.E8562000.00000004.mdmp")42:T817,"truetrue