24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fe,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 6c4229ac9e24… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6c4229ac9e24…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503"],"about":{"@type":"SoftwareApplication","name":"6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb0a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.72000000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.72000000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.72000000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp")26:T7ac,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "w64GetThreadContext" (Indicator: "GetThreadContext"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.72000000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.72000000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp")27:Te6e,Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00008072.00000000.179921.6F5B0000.00000004.mdmp, 00000000-00008072.00000000.179921.AA22D000.00000002.mdmp")28:Tf7e,Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2143-0000000140048690 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2143-0000000140048690 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2143-0000000140048690 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2143-0000000140048690 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2262-0000000140058BC0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2262-0000000140058BC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2262-0000000140058BC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2262-0000000140058BC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2264-00000001400585A0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2264-00000001400585A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2264-00000001400585A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2264-00000001400585A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2265-00000001400583C0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2265-00000001400583C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2265-00000001400583C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2265-00000001400583C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2266-00000001400581D0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2266-00000001400581D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2266-00000001400581D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2266-00000001400581D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2319-00000001400503D0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2319-00000001400503D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2319-00000001400503D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2319-00000001400503D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-2321-00000001400501B0 Assembly shows XOR instruction xor eax esp in Stream UID: 25648-2321-00000001400501B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-2321-00000001400501B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-2321-00000001400501B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-3242-000000014005157B Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-3242-000000014005157B Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-4181-00000001400A8638 Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-4181-00000001400A8638 Assembly shows XOR instruction xor rax rsp in Stream UID: 25648-4200-00000001400A997A Assembly shows XOR instruction xor eax esp in Stream UID: 25648-4200-00000001400A997A Assembly shows XOR instruction xor rcx rsp in Stream UID: 25648-4200-00000001400A997A Assembly shows XOR instruction xor ecx esp in Stream UID: 25648-4200-00000001400A997A Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor rax rcx in Stream UID: 25648-5863-00000001400A7BDD Assembly shows XOR instruction xor eax ecx in Stream UID: 25648-5863-00000001400A7BDD29:T21c6,Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 17804; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 17950; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 41733; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 65462; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 66794; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 67801; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 67935; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 68005; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 151837; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 205872; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 213875; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 342183; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 684079; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 983675; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 18558; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 384927; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 385014; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 385079; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 416447; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 464287; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 464370; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 464431; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 820927; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 852324; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe" at offset 991139; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 17804; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 17950; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 41733; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 65462; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 66794; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 67801; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 67935; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 68005; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 151837; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 205872; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 213875; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 342183; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 684079; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 983675; code bytes = 33c1 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 18558; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 384927; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 385014; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 385079; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 416447; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 464287; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 464370; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 464431; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 820927; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 852324; code bytes = 8030 Found XOR loop in file "6c4229ac9e24a9d1444a5bc37f0d3fdb16befe906fd0005138a52ae65ccb0503.bin.exe.bin" at offset 991139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 17804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 65462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 66794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 151837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 213875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 342183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 684079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 983675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385014; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 416447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 852324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991139; code bytes = 80302a:T16ae,"