26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 11e795305b7f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 11e795305b7f…. Malware family: Trojan.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5"],"about":{"@type":"SoftwareApplication","name":"11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin","applicationCategory":["peexe","autoit","executable"],"identifier":"11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8c3,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp, 00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp, 00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp")28:T99a,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp")29:T5c0,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp, 00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp")2a:T58e,Found reference to "System.Security.Cryptography.RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp")2b:Td62,Found api reference "CryptGetHashParam(2)" (Indicator: "CryptGetHashParam"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptSetHashParam(5)" (Indicator: "CryptSetHashParam"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptDeriveKey" (Indicator: "CryptDeriveKey"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005908.00000000.165907.061B0000.00000004.mdmp")2c:T1497,Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005908-25926-8-00DD0A0C Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005908-25926-8-00DD0A0C Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005908-25926-8-00DD0A0C Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005908-25926-8-00DD0A0C Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005908-25926-8-00DD0A0C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-38-00DE31F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-38-00DE31F4 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005908-25926-39-00DE2F67 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005908-25926-39-00DE2F67 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-44-00DE319E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-44-00DE319E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-92-00DE25B2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-92-00DE25B2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-96-00DE5A39 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-96-00DE5A39 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-97-00DE5654 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-97-00DE5654 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-99-00DE5821 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-99-00DE5821 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-100-00DE5733 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-100-00DE5733 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-101-00DE53BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-101-00DE53BE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-115-00DD4CFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-115-00DD4CFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-205-00DED863 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-205-00DED863 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-212-00DE618E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-212-00DE618E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-213-00DE33F7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-213-00DE33F7 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005908-25926-245-00DE66FB Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005908-25926-245-00DE66FB Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005908-25926-245-00DE66FB Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005908-25926-245-00DE66FB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-253-00DEAF28 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-253-00DEAF28 Assembly shows XOR instruction xor esi dword ptr [00E80730h] in Stream UID: 00000000-00005908-25926-333-00DD0178 Assembly shows XOR instruction xor esi dword ptr [00E8072Ch] in Stream UID: 00000000-00005908-25926-347-00DD0256 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-374-00DF14C2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-374-00DF14C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-375-00DE307E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-375-00DE307E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-397-00DECB1C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-397-00DECB1C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-400-00DEC7C7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-400-00DEC7C7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-418-00DE32CF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-418-00DE32CF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-432-00DE324D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-432-00DE324D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005908-25926-437-00DE3325 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005908-25926-437-00DE33252d:Tf2e,Found XOR loop in file "sample.bin" at offset 21997; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 111259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 112690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 691290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 884876; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1060991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1062958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1064222; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1292345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1299877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1301047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1315561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 130662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 139931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 140060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 385536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 463547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 463622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 596817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 702010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 709349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 709797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 710373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 710821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1047285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1158155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1211674; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1251328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1292541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1295773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1309535; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1309969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1310097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1312601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 358205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 367958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 432527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 575033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 674804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 993999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1109319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1156045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1266391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1282235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1296634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1315522; code bytes = 80302e:T5f4,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp")2f:T47a,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp")30:T41c,Found system information discovery API: "GetNativeSystemInfo" in file "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin" Found system information discovery API: "GetSystemInfo" in file "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin" Found system information discovery API: "GetMonitorInfoW" in file "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp"31:T7b2,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5.bin") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00005908.00000000.165907.00E4C000.00000002.mdmp")32:T775,"