26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample e2f9de6a44a8… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample e2f9de6a44a8…. Malware family: Win/malicious_confidence_70%. Threat score 86/100. 2/26 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c"],"about":{"@type":"SoftwareApplication","name":"e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d6,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp")28:T5f7e,Found api reference "goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugin" (Indicator: "CertOpenStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625i" (Indicator: "CertCloseStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625i" (Indicator: "CryptGenRandom"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "akeup298023223876953125value out of range10 mail.example.combad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125additional auth datainvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstat" (Indicator: "CertOpenSystemStoreW"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125additional auth datainvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstat" (Indicator: "CryptAcquireContextW"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "call not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over m" (Indicator: "CertGetCertificateChain"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "arkroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanick" (Indicator: "CertFreeCertificateChain"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in fi" (Indicator: "CertFreeCertificateContext"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "nalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "goal cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugi" (Indicator: "CertOpenStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625" (Indicator: "CertCloseStore"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=1907348632812595367431640625" (Indicator: "CryptGenRandom"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125additional auth datainvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredsta" (Indicator: "CertOpenSystemStoreW"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125additional auth datainvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredsta" (Indicator: "CryptAcquireContextW"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "call not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over" (Indicator: "CertGetCertificateChain"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "arkroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanic" (Indicator: "CertFreeCertificateChain"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in f" (Indicator: "CertFreeCertificateContext"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp 00000000-00001396.00000001.118383.1C460000.00000004.mdmp 00000000-00001396.00000002.120306.1C460000.00000004.mdmp")29:Tdc30,Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 113562; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 977805; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 981140; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 983565; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 989283; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 996365; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1003605; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1013026; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1014988; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1015302; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1020294; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1023308; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1024909; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1040283; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1339289; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1340934; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1538849; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1625889; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1625921; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1892217; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2156606; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2237601; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2836057; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2886030; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2912365; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2991186; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3004188; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3015652; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3029376; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3059265; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3146066; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3209056; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3325249; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3377231; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3378528; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3443200; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3534625; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3679314; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3680577; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3787385; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3825683; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4084459; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4719178; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4832543; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5461464; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5782916; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5801572; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5890752; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5895617; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5956033; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6026983; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6358177; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6535190; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6824580; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6875748; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7189124; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7271492; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7272644; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7546738; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7590278; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7675169; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7708209; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7745569; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7785980; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8154151; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8244100; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8267398; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8683031; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8865320; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9137636; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9241580; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9553764; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9884740; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9918780; code bytes = 30d0 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 346185; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1312916; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1321153; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1355961; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1357126; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1369066; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1370934; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1382113; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1384839; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1428922; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1908473; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1908601; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2427981; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2505102; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2765870; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2771118; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2926954; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2927978; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2929258; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2940558; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3254098; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3505106; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3555172; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3774681; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4208130; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4213641; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4224329; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4230537; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4232009; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4248713; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4250953; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4258249; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4258633; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4261449; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4262665; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4286729; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4401026; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4836738; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4845449; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4887874; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5012970; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5558210; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5596482; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5648882; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5683983; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5694368; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5934743; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6755855; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6757263; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7060978; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7258721; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7350095; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7373764; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7526223; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7593521; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7770290; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7835471; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7840847; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7879951; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7945167; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8537444; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8817576; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8953147; code bytes = 33c1 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 215958; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 415261; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 441925; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 442621; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 443262; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 971909; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 975237; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 995082; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 996683; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1012632; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1015315; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1031997; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1037871; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1041469; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1048605; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1095597; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1098597; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1101513; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1121913; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1177585; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1316970; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1353455; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1543327; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1629521; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 1766993; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2033105; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2243953; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2304561; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2339729; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2629249; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2898289; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2900097; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2906193; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2911377; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 2935065; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3086477; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3110599; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3153279; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3206239; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3229951; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3243437; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3349831; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3357151; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3383879; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3400827; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3436246; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3445585; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3476935; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3485809; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3519821; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3570375; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3570503; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3583047; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3608846; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3622742; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3638783; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3664199; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3784141; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3795448; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3797503; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3818669; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3821407; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3831111; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3854279; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3924167; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3931505; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3960401; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3976191; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 3981383; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4074766; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4079431; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4101319; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4688321; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4734077; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4902953; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4910417; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4924073; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4940981; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4959877; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 4993833; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5025961; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5056725; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5108497; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5209001; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5217961; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5222441; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5228521; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5231457; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5233377; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5326517; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5377429; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5515641; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5642217; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5799391; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5896688; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5942911; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 5964529; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6137396; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6220255; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6231594; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6231978; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6280022; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6320116; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6432429; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6720800; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 6813682; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7224015; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7324451; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7403761; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7561507; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 7677283; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8273209; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 8949483; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9020912; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9215314; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9455680; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9488457; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 9799729; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 10248712; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 10292180; code bytes = 8030 Found XOR loop in file "ovd_4f3532e203a7.exe.bin" at offset 10295852; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 113562; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 977805; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 981140; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 983565; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 989283; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 996365; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1003605; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1013026; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1014988; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1015302; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1020294; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1023308; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1024909; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1040283; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1339289; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1340934; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1538849; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1625889; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1625921; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 1892217; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2156606; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2237601; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2836057; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2886030; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2912365; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 2991186; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3004188; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3015652; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3029376; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3059265; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3146066; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3209056; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3325249; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3377231; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3378528; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3443200; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3534625; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3679314; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3680577; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3787385; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 3825683; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 4084459; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 4719178; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 4832543; code bytes = 30d0 Found XOR loop in file "agent-3898252010.tmp" at offset 346185; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1312916; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1321153; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1355961; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1357126; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1369066; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1370934; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1382113; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1384839; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1428922; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1908473; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 1908601; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2427981; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2505102; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2765870; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2771118; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2926954; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2927978; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2929258; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 2940558; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 3254098; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 3505106; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 3555172; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 3774681; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4208130; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4213641; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4224329; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4230537; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4232009; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4248713; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4250953; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4258249; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4258633; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4261449; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4262665; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4286729; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4401026; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4836738; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4845449; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 4887874; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 5012970; code bytes = 33c1 Found XOR loop in file "agent-3898252010.tmp" at offset 215958; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 415261; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 441925; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 442621; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 443262; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 971909; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 975237; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 995082; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 996683; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1012632; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1015315; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1031997; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1037871; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1041469; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1048605; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1095597; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1098597; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1101513; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1121913; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1177585; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1316970; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1353455; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1543327; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1629521; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 1766993; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2033105; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2243953; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2304561; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2339729; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2629249; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2898289; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2900097; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2906193; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2911377; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 2935065; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3086477; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3110599; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3153279; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3206239; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3229951; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3243437; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3349831; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3357151; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3383879; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3400827; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3436246; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3445585; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3476935; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3485809; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3519821; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3570375; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3570503; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3583047; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3608846; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3622742; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3638783; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3664199; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3784141; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3795448; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3797503; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3818669; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3821407; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3831111; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3854279; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3924167; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3931505; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3960401; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3976191; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 3981383; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4074766; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4079431; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4101319; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4688321; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4734077; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4902953; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4910417; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4924073; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4940981; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4959877; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 4993833; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5025961; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5056725; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5108497; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5209001; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5217961; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5222441; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5228521; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5231457; code bytes = 8030 Found XOR loop in file "agent-3898252010.tmp" at offset 5233377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 113562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 977805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 981140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 983565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 989283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 996365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1003605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1013026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1014988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1015302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1020294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1023308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1024909; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1040283; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1339289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1538849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1625889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1625921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1892217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2156606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2237601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2836057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2886030; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2912365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2991186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3004188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3015652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3029376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3059265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3146066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3209056; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3325249; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3377231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3378528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3443200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3534625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3679314; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3680577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3787385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3825683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4084459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4719178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4832543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5461464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5782916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5801572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5890752; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5895617; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5956033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6026983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6358177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6535190; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6824580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6875748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7189124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7271492; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7272644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7546738; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7590278; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7675169; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7708209; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7745569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7785980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8154151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8244100; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8267398; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8683031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8865320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9137636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9241580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9553764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9884740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9918780; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 346185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1312916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1321153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1355961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1357126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1370934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1382113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1428922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1908473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1908601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2427981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2505102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2765870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2771118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2926954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2927978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2929258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2940558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3254098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3505106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3555172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3774681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4208130; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4213641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4224329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4230537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4232009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4248713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4250953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4258249; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4258633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4261449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4262665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4286729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4401026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4836738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4845449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4887874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5012970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5558210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5596482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5648882; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5683983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5694368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5934743; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6755855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6757263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7060978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7258721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7350095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7373764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7526223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7593521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7770290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7835471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7840847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7879951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7945167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8537444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8817576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8953147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 215958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 415261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 441925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 442621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 443262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 971909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 975237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 996683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1012632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1015315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1031997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1037871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1041469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1048605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1095597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1098597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1101513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1177585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1316970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1353455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1543327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1629521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1766993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2033105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2243953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2304561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2339729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2629249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2898289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2900097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2906193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2911377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2935065; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3086477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3110599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3153279; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3206239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3229951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3243437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3349831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3357151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3383879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3400827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3436246; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3445585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3476935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3485809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3519821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3570375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3570503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3583047; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3608846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3622742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3638783; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3664199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3784141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3795448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3797503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3818669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3821407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3831111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3854279; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3924167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3931505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3960401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3976191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3981383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4074766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4079431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4101319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4688321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4734077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4902953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4910417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4924073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4940981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4959877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4993833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5025961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5056725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5108497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5209001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5217961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5222441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5228521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5231457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5233377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5326517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5377429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5515641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5642217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5799391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5896688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5942911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5964529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6137396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6220255; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6231594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6231978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6280022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6320116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6432429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6720800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6813682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7224015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7324451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7403761; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7561507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7677283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8273209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8949483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9020912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9215314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9455680; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9488457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9799729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10248712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10292180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10295852; code bytes = 80302a:T775,"`.cr" Heuristic match: "r`.pr" Heuristic match: "+d.ws" Heuristic match: "%=.ee" Heuristic match: "-%=.ge" Heuristic match: "%=.ye" Heuristic match: "%#.be" Heuristic match: "?r,.vg" Heuristic match: "% .er" Heuristic match: "_ g.la" Heuristic match: "j .hr" Heuristic match: "& .lr" Heuristic match: "><.me" Heuristic match: "4=.mw" Heuristic match: "%.tv" Heuristic match: "g `.pr" Heuristic match: "%.pk" Heuristic match: "o?.cf" Heuristic match: "c `.pr" Heuristic match: "- `.cv" Heuristic match: "-9.jm" Heuristic match: "me eg.tl" Heuristic match: "`a'.la" Heuristic match: "%$.dk" Heuristic match: "&8.ni" Heuristic match: "%!.to" Heuristic match: "'5e.vu" Heuristic match: "6'.by" Heuristic match: "/'.kn" Heuristic match: ")'.gq" Heuristic match: "!$.fi" Heuristic match: "%!.ad" Heuristic match: "> .af" Heuristic match: "7~.tw" Heuristic match: "-!>.ni" Heuristic match: "%>.hm" Heuristic match: "%~.re" Heuristic match: "xj .is" Heuristic match: "k .sr" Pattern match: "https://91.92.241.175:5173/api/clients/a8277bd07ccb31d9cb7ed65babad45311dc82dc08facef6635087bdcd780625b/stream/ws?role=client"34:T1365,Found reference to API "11830906703,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831437145,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11830946019,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831273691,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831235877,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831077647,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831757365,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831041421,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831714675,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831587745,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831677721,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831625773,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "11831489387,6080,103,,GetAsyncKeyState,user32.dll,"00:30:19.781",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.1C460000.00000004.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp") Found reference to API "83715142281,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83714661589,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715527904,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715475990,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715053973,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715102877,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715222581,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715656172,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715726790,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83715348634,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp") Found reference to API "83714962139,6464,103,,GetAsyncKeyState,user32.dll,"00:30:49.734",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001396.00000001.118383.1C460000.00000004.mdmp")35:Te3d,Found string "chacha8" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "aes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "aeshashbody" (Indicator: "aes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "runtime.useAeshash" (Indicator: "aes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "runtime.useAeshash" (Indicator: "aes"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "runtime.aeskeysched" (Indicator: "aes"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; Source: "00000000-00001396.00000002.120306.3E012000.00000002.mdmp")36:T56e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetProcAddress"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp, 00000000-00001396.00000002.120306.3E012000.00000002.mdmp")37:T68a,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") Found reference to API "C:\Users\HAPUBWS\AppData\RoamingC:\Users\HAPUBWS\AppData\RoamingGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001396.00000000.116466.7A000000.00000004.mdmp") Found reference to API "Failed to find GetTempPath2W procedure in kernel32.dll: The specified procedure could not be found." (Indicator: "GetTempPath"; Source: "00000000-00001396.00000000.116466.7A100000.00000004.mdmp")38:T413,file/memory contains long string with (Indicator: "GetUserName"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "e2f9de6a44a845250beaeced45aeabdb2dd2b754ab626b2f5b70d9dd2d8cb84c.bin")39:T9d7," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69c401e780485b8f1f062521"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Removes an item from the Startup folder","description":"\"