Edit tour

Windows Analysis Report
Crosshair-X.exe

Overview

General Information

Sample name:	Crosshair-X.exe
Analysis ID:	1581745
MD5:	ffc5dbf6966dd3383faeed15eafeeee9
SHA1:	dd1c357fa9c982a3a7824f7ef7043c8185e1ab0c
SHA256:	ba21ca2f38d1d1c6b72b3974c3e610080fc1dd0c82fefa7a5b2d5ece070cd5f9
Tags:	exeuser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Crosshair-X.exe (PID: 5288 cmdline: "C:\Users\user\Desktop\Crosshair-X.exe" MD5: FFC5DBF6966DD3383FAEED15EAFEEEE9)

conhost.exe (PID: 2008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Crosshair-X.exe (PID: 4464 cmdline: "C:\Users\user\Desktop\Crosshair-X.exe" MD5: FFC5DBF6966DD3383FAEED15EAFEEEE9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bellflamre.click", "screwamusresz.buzz", "inherineau.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "hummskitnj.buzz"], "Build id": "LPnhqo--imqylxxhmnff"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:29.455229+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	104.121.10.34	443	TCP
2024-12-28T22:04:32.056310+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-28T22:04:33.556119+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:32.804055+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:32.804055+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	104.21.66.86	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:27.056657+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.4	56101	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:25.580278+0100	2058212	1	Domain Observed Used for C2 Detected	192.168.2.4	57277	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:27.287632+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.4	62404	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:27.558459+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.4	59981	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:26.540857+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.4	62739	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:25.816923+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.4	65153	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:26.036008+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.4	52835	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:26.265858+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.4	60362	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:26.770947+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.4	59004	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T22:04:30.363659+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	104.121.10.34	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/vop	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi&	Avira URL Cloud: Label: malware
Source: https://cashfuzysao.buzz/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apipE	Avira URL Cloud: Label: malware
Source: https://hummskitnj.buzz/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/vo	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/pi-	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/$B	Avira URL Cloud: Label: malware
Source: https://appliacnesot.buzz/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["bellflamre.click", "screwamusresz.buzz", "inherineau.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "hummskitnj.buzz"], "Build id": "LPnhqo--imqylxxhmnff"}

Multi AV Scanner detection for submitted file

Source: Crosshair-X.exe

Virustotal: Detection: 32%

Perma Link

Machine Learning detection for sample

Source: Crosshair-X.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--imqylxxhmnff

Source: Crosshair-X.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_00861FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00861FE9

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	2_2_0040AECE
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edi, byte ptr [edx]	2_2_0040AECE
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-14h]	2_2_0043DFFB
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 31E2A9F4h	2_2_00439870
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then test eax, eax	2_2_00439870
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 4B1BF3DAh	2_2_00439870
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042A010
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+589521F5h]	2_2_00440810
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000E4h]	2_2_00426820
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-77h]	2_2_00426820
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp edx	2_2_00423026
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00423026
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp edx	2_2_00423026
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], EABBD981h	2_2_0040E030
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov esi, dword ptr [ebp+08h]	2_2_00416036
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_00416036
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then lea ebx, dword ptr [edi-80000000h]	2_2_00416036
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ebx, bx	2_2_004258CC
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_0041D0A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov edx, ecx	2_2_004151B0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [esi+ecx+02h], 0000h	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov word ptr [edx], cx	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-45h]	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, ebx	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov edx, ecx	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov esi, eax	2_2_0041E240
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+04AB0530h]	2_2_0041E240
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00435A00
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax+38A2D7F7h]	2_2_00429211
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx eax, word ptr [ebp+ecx+00h]	2_2_00422220
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_004252C9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+000000A0h]	2_2_00422AC9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], DA026237h	2_2_00422AC9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	2_2_00419A92
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax+38A2D7F7h]	2_2_004292B0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0042DB13
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	2_2_00428310
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov edi, esi	2_2_0043EB88
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	2_2_00402BB0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov edx, ecx	2_2_0040C3B4
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, eax	2_2_0042C47F
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov edx, ecx	2_2_0042C47F
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+589521F5h]	2_2_00440400
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00407410
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00407410
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-748B770Eh]	2_2_00440C30
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_0042DCE4
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04273BF7h]	2_2_0040E498
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ebx, edx	2_2_0043F540
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_0043F540
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp eax	2_2_00439550
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Ch]	2_2_00438DC0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, ebp	2_2_00408DE0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00421E40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_0043F660
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_0043F67B
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_0043F679
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp byte ptr [esi+ebp], 00000000h	2_2_0042A630
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov byte ptr [esi], al	2_2_0042C6E3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp eax	2_2_00427EEB
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	2_2_00428690
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then cmp word ptr [ebp+ecx+00h], 0000h	2_2_00422750
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00422750
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, eax	2_2_0042B75C
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, eax	2_2_0042B766
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax]	2_2_00423730
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then push esi	2_2_00420FC3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then jmp ecx	2_2_0043F7A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 4x nop then mov ecx, eax	2_2_0042B5D9

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.4:65153 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.4:52835 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.4:60362 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.4:62404 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.4:59981 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.4:56101 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.4:62739 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.4:59004 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058212 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click) : 192.168.2.4:57277 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49730 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bellflamre.click
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 104.121.10.34 104.121.10.34

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 104.21.66.86:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: Crosshair-X.exe, 00000002.00000003.1751446494.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connec equals www.youtube.com (Youtube)
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=01822199e6c2252921d66452; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 21:04:30 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bellflamre.click
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Crosshair-X.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: Crosshair-X.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Crosshair-X.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Crosshair-X.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Crosshair-X.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Crosshair-X.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Crosshair-X.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Crosshair-X.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Crosshair-X.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Crosshair-X.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Crosshair-X.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Crosshair-X.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781997835.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782391559.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774488846.0000000003236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Crosshair-X.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Crosshair-X.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appliacnesot.buzz/api
Source: Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.000000000323F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1782021358.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782438282.000000000324B000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cashfuzysao.buzz/api
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781997835.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782391559.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774488846.0000000003236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1782021358.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782438282.000000000324B000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hummskitnj.buzz/api
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/$B
Source: Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apipE
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi&
Source: Crosshair-X.exe, 00000002.00000002.1782309305.0000000003214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi-
Source: Crosshair-X.exe, 00000002.00000002.1782309305.0000000003214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/vo
Source: Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/vop
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.000000000323F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781997835.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782391559.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774488846.0000000003236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Crosshair-X.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 2_2_00433330 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00433330

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 2_2_00433330 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_00433330

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 2_2_004334D0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

2_2_004334D0

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00841000	0_2_00841000
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0084F555	0_2_0084F555
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00867792	0_2_00867792
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00859CC0	0_2_00859CC0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00865C5E	0_2_00865C5E
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00853FB2	0_2_00853FB2
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00441800	2_2_00441800
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040BA35	2_2_0040BA35
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040AECE	2_2_0040AECE
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00408680	2_2_00408680
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043DFFB	2_2_0043DFFB
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F050	2_2_0043F050
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00440060	2_2_00440060
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00439870	2_2_00439870
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00418003	2_2_00418003
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00440810	2_2_00440810
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00426820	2_2_00426820
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00423026	2_2_00423026
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041702A	2_2_0041702A
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00416036	2_2_00416036
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004380E5	2_2_004380E5
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043C8F0	2_2_0043C8F0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043C090	2_2_0043C090
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040A8A0	2_2_0040A8A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041D8A0	2_2_0041D8A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042D0B6	2_2_0042D0B6
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004158BA	2_2_004158BA
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00405940	2_2_00405940
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00425150	2_2_00425150
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00403900	2_2_00403900
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042B929	2_2_0042B929
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042D1CF	2_2_0042D1CF
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004061A0	2_2_004061A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004229B7	2_2_004229B7
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004261BB	2_2_004261BB
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004371B9	2_2_004371B9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042D1BC	2_2_0042D1BC
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00409240	2_2_00409240
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00414A40	2_2_00414A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041E240	2_2_0041E240
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00432A40	2_2_00432A40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00441A50	2_2_00441A50
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041225F	2_2_0041225F
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041CA00	2_2_0041CA00
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00422220	2_2_00422220
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004252C9	2_2_004252C9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004242D4	2_2_004242D4
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00411ADC	2_2_00411ADC
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004172E7	2_2_004172E7
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041B2E6	2_2_0041B2E6
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00427AF9	2_2_00427AF9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004042B0	2_2_004042B0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00426B60	2_2_00426B60
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00428310	2_2_00428310
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040F33C	2_2_0040F33C
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00404BE0	2_2_00404BE0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00426B80	2_2_00426B80
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00419395	2_2_00419395
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041F3A0	2_2_0041F3A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040C3B4	2_2_0040C3B4
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042EC73	2_2_0042EC73
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00438400	2_2_00438400
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00440400	2_2_00440400
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00407410	2_2_00407410
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00440C30	2_2_00440C30
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043FC80	2_2_0043FC80
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040E498	2_2_0040E498
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00437CA2	2_2_00437CA2
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00427CA8	2_2_00427CA8
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041702A	2_2_0041702A
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F540	2_2_0043F540
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043C540	2_2_0043C540
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00439550	2_2_00439550
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00412560	2_2_00412560
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0041DD60	2_2_0041DD60
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00438DC0	2_2_00438DC0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_004315E0	2_2_004315E0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042ADF0	2_2_0042ADF0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00421E40	2_2_00421E40
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00438660	2_2_00438660
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F660	2_2_0043F660
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F67B	2_2_0043F67B
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F679	2_2_0043F679
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00409620	2_2_00409620
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042B629	2_2_0042B629
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00406630	2_2_00406630
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042A630	2_2_0042A630
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00419EE0	2_2_00419EE0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00428690	2_2_00428690
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042D69A	2_2_0042D69A
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00410EA3	2_2_00410EA3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00425750	2_2_00425750
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00432F50	2_2_00432F50
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00402F00	2_2_00402F00
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00423730	2_2_00423730
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00434FCC	2_2_00434FCC
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00408FD0	2_2_00408FD0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0040D7D4	2_2_0040D7D4
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042F7FD	2_2_0042F7FD
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00424F95	2_2_00424F95
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F7A0	2_2_0043F7A0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00439FA7	2_2_00439FA7
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0042C7B0	2_2_0042C7B0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00841000	2_2_00841000
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0084F555	2_2_0084F555
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00867792	2_2_00867792
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00859CC0	2_2_00859CC0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00865C5E	2_2_00865C5E
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00853FB2	2_2_00853FB2

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 0084FA60 appears 100 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 00414A30 appears 61 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 0085CFD6 appears 40 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 0084FAE4 appears 34 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 008580F8 appears 42 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 00408050 appears 46 times
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: String function: 00850730 appears 38 times

Source: Crosshair-X.exe, 00000000.00000000.1671187834.00000000008CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Crosshair-X.exe
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Crosshair-X.exe
Source: Crosshair-X.exe, 00000002.00000000.1694351714.00000000008CF000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Crosshair-X.exe
Source: Crosshair-X.exe, 00000002.00000003.1698816480.0000000004DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Crosshair-X.exe
Source: Crosshair-X.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Crosshair-X.exe

Source: Crosshair-X.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Crosshair-X.exe

Static PE information: Section: .bss ZLIB complexity 1.0003393954918032

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/1@11/2

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 2_2_004310A0 CoCreateInstance,

2_2_004310A0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2008:120:WilError_03

Source: Crosshair-X.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Crosshair-X.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Crosshair-X.exe

Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\Crosshair-X.exe

File read: C:\Users\user\Desktop\Crosshair-X.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Crosshair-X.exe "C:\Users\user\Desktop\Crosshair-X.exe"
Source: C:\Users\user\Desktop\Crosshair-X.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Crosshair-X.exe	Process created: C:\Users\user\Desktop\Crosshair-X.exe "C:\Users\user\Desktop\Crosshair-X.exe"
Source: C:\Users\user\Desktop\Crosshair-X.exe	Process created: C:\Users\user\Desktop\Crosshair-X.exe "C:\Users\user\Desktop\Crosshair-X.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Crosshair-X.exe

Static file information: File size 100205096 > 1048576

Source: Crosshair-X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Crosshair-X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Crosshair-X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Crosshair-X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Crosshair-X.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0084FB83 push ecx; ret	0_2_0084FB96
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0044547A push cs; ret	2_2_004454B2
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043F4D0 push eax; mov dword ptr [esp], 60636255h	2_2_0043F4D3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0043C490 push eax; mov dword ptr [esp], 0B08090Eh	2_2_0043C49E
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00449CA4 push ebp; iretd	2_2_00449CA6
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0084FB83 push ecx; ret	2_2_0084FB96

Source: C:\Users\user\Desktop\Crosshair-X.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-21961

Source: C:\Users\user\Desktop\Crosshair-X.exe

API coverage: 4.1 %

Source: C:\Users\user\Desktop\Crosshair-X.exe TID: 3272	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Crosshair-X.exe TID: 6356	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_00861FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00861FE9

Source: Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1782021358.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782438282.000000000324B000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782309305.00000000031FC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 2_2_0043DD60 LdrInitializeThunk,

2_2_0043DD60

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_0084F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0084F8E9

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0087A19E mov edi, dword ptr fs:[00000030h]	0_2_0087A19E
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00841FB0 mov edi, dword ptr fs:[00000030h]	0_2_00841FB0
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00841FB0 mov edi, dword ptr fs:[00000030h]	2_2_00841FB0

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_0085D8E0 GetProcessHeap,

0_2_0085D8E0

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0084F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0084F52D
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0084F8DD SetUnhandledExceptionFilter,	0_2_0084F8DD
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_0084F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0084F8E9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 0_2_00857E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00857E30
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0084F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0084F52D
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0084F8DD SetUnhandledExceptionFilter,	2_2_0084F8DD
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_0084F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0084F8E9
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: 2_2_00857E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00857E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_0087A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0087A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Crosshair-X.exe

Memory written: C:\Users\user\Desktop\Crosshair-X.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: Crosshair-X.exe, 00000000.00000002.1696048543.0000000004846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click

Source: C:\Users\user\Desktop\Crosshair-X.exe

Process created: C:\Users\user\Desktop\Crosshair-X.exe "C:\Users\user\Desktop\Crosshair-X.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	0_2_0085D1BD
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00861287
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	0_2_008614D8
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00861580
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	0_2_008617D3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	0_2_00861840
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	0_2_00861915
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	0_2_00861960
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00861A07
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	0_2_00861B0D
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	0_2_0085CC15
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	2_2_0085D1BD
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00861287
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	2_2_008614D8
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00861580
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	2_2_008617D3
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	2_2_00861840
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: EnumSystemLocalesW,	2_2_00861915
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	2_2_00861960
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00861A07
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	2_2_00861B0D
Source: C:\Users\user\Desktop\Crosshair-X.exe	Code function: GetLocaleInfoW,	2_2_0085CC15

Source: C:\Users\user\Desktop\Crosshair-X.exe

Code function: 0_2_008500B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_008500B4

Source: C:\Users\user\Desktop\Crosshair-X.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	211 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Crosshair-X.exe	32%	Virustotal		Browse
Crosshair-X.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lev-tolstoi.com/vop	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/pi&	100%	Avira URL Cloud	malware
https://cashfuzysao.buzz/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apipE	100%	Avira URL Cloud	malware
https://hummskitnj.buzz/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/vo	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/pi-	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/$B	100%	Avira URL Cloud	malware
https://appliacnesot.buzz/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.121.10.34	true	false	high
lev-tolstoi.com	104.21.66.86	true	false	high
cashfuzysao.buzz	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
bellflamre.click	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
hummskitnj.buzz	false	high
bellflamre.click	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi-	Crosshair-X.exe, 00000002.00000002.1782309305.0000000003214000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781997835.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782391559.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774488846.0000000003236000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.entrust.net/rpa03	Crosshair-X.exe	false		high
http://store.steampowered.com/privacy_agreement/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apipE	Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/points/shop/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/pi&	Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781997835.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782391559.0000000003236000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774488846.0000000003236000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://appliacnesot.buzz/api	Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.entrust.net/2048ca.crl0	Crosshair-X.exe	false		high
https://store.steampowered.com/;	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.entrust.net/rpa0	Crosshair-X.exe	false		high
https://store.steampowered.com/about/	Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	Crosshair-X.exe	false		high
http://ocsp.entrust.net02	Crosshair-X.exe	false		high
https://help.steampowered.com/en/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cashfuzysao.buzz/api	Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1782021358.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782438282.000000000324B000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/$B	Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apis	Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774464726.0000000003259000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hummskitnj.buzz/api	Crosshair-X.exe, 00000002.00000003.1774413361.0000000003249000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1782021358.000000000324A000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782438282.000000000324B000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751400814.000000000324A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/stats/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/vop	Crosshair-X.exe, 00000002.00000003.1781975436.0000000003259000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.0000000003247000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000002.1782450389.000000000325A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/ts1ca.crl0	Crosshair-X.exe	false		high
https://steamcommunity.com/workshop/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/vo	Crosshair-X.exe, 00000002.00000002.1782309305.0000000003214000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aia.entrust.net/ts1-chain256.cer01	Crosshair-X.exe	false		high
https://store.steampowered.com/	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1781937278.000000000323F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	Crosshair-X.exe, 00000002.00000003.1751354434.0000000003297000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774380805.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1751354434.000000000328F000.00000004.00000020.00020000.00000000.sdmp, Crosshair-X.exe, 00000002.00000003.1774413361.000000000323E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
104.121.10.34	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581745
Start date and time:	2024-12-28 22:03:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Crosshair-X.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/1@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 37 Number of non-executed functions: 159
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:04:24	API Interceptor	8x Sleep call for process: Crosshair-X.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
104.121.10.34	Installer.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
steamcommunity.com	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	48.252.190.9.zip	Get hash	malicious	Unknown	Browse	23.206.103.35
	Installer.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse	2.19.198.40
	SoftWare(1).exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ForcesLangi.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Leside-.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	Setup.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	23.57.90.162
CLOUDFLARENETUS	setup.msi	Get hash	malicious	Unknown	Browse	172.67.165.214
	!Set-up..exe	Get hash	malicious	LummaC Stealer	Browse	172.67.75.40
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.26.3.16
	ZZ2sTsJFrt.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	FB.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	104.26.9.163
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.87.112
	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	104.21.34.5
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	!Set-up..exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 104.121.10.34
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 104.121.10.34
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	SgMuuLxOCJ.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 104.121.10.34

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Crosshair-X.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	0.09649414149847303
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Crosshair-X.exe
File size:	100'205'096 bytes
MD5:	ffc5dbf6966dd3383faeed15eafeeee9
SHA1:	dd1c357fa9c982a3a7824f7ef7043c8185e1ab0c
SHA256:	ba21ca2f38d1d1c6b72b3974c3e610080fc1dd0c82fefa7a5b2d5ece070cd5f9
SHA512:	3bc56d599e0ed45c42c8d10d77a493e82eb92f182843cd9847a35863dce540c41b6c697506116f3597e01c855ff9e3ba953a92c904b9179f11249e4c5d762411
SSDEEP:	12288:LYO6Dqzihouxpa+yWxKiZL74U5/314oCqG2oMUZZGN22TaLY5EO:UO6DThou2+y+H/qTqKHGE2b5t
TLSH:	1B28D0123690C4B2C9531D724AB9D779193EB8100F615ACBA7A84BBECEB07F14F3165E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng.....................\....................@..........................@......^.....@.................................\|j..<..

File Icon


Icon Hash:	0f45869392ce6d17

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F5C89424EEAh
jmp 00007F5C89424D4Dh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F5C89424EE6h
test esi, ecx
jne 00007F5C89424F08h
call 00007F5C89424F11h
mov ecx, eax
cmp ecx, edi
jne 00007F5C89424EE9h
mov ecx, BB40E64Fh
jmp 00007F5C89424EF0h
test esi, ecx
jne 00007F5C89424EECh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F5C8942BCC3h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x4284	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x89c00	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x4c400	0x4c400	aa329b78b04dd05f5083c0e92bab95c9	False	1.0003393954918032	data	7.999363295829706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x4284	0x4400	573fd821fa82f273bc00b41f87649450	False	0.9294577205882353	data	7.7267577156155784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x8f16c	0x3d60	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9851705702647657
RT_GROUP_ICON	0x92ecc	0x14	data			1.05
RT_VERSION	0x92ee0	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T22:04:25.580278+0100	2058212	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bellflamre .click)	1	192.168.2.4	57277	1.1.1.1	53	UDP
2024-12-28T22:04:25.816923+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.4	65153	1.1.1.1	53	UDP
2024-12-28T22:04:26.036008+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.4	52835	1.1.1.1	53	UDP
2024-12-28T22:04:26.265858+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.4	60362	1.1.1.1	53	UDP
2024-12-28T22:04:26.540857+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.4	62739	1.1.1.1	53	UDP
2024-12-28T22:04:26.770947+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.4	59004	1.1.1.1	53	UDP
2024-12-28T22:04:27.056657+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.4	56101	1.1.1.1	53	UDP
2024-12-28T22:04:27.287632+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.4	62404	1.1.1.1	53	UDP
2024-12-28T22:04:27.558459+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.4	59981	1.1.1.1	53	UDP
2024-12-28T22:04:29.455229+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	104.121.10.34	443	TCP
2024-12-28T22:04:30.363659+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49730	104.121.10.34	443	TCP
2024-12-28T22:04:32.056310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-28T22:04:32.804055+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-28T22:04:32.804055+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	104.21.66.86	443	TCP
2024-12-28T22:04:33.556119+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	104.21.66.86	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:04:28.013012886 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:28.013050079 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:28.013271093 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:28.016197920 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:28.016208887 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:29.455144882 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:29.455229044 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:29.457986116 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:29.457998991 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:29.458236933 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:29.509085894 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:29.548300028 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:29.595336914 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363656044 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363679886 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363687992 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363699913 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363706112 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363876104 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.363876104 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.363902092 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.363965034 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.490840912 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.490865946 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.491065025 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.491089106 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.491147995 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.499322891 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.499408960 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.499414921 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.499466896 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.500757933 CET	49730	443	192.168.2.4	104.121.10.34
Dec 28, 2024 22:04:30.500773907 CET	443	49730	104.121.10.34	192.168.2.4
Dec 28, 2024 22:04:30.840311050 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:30.840370893 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:30.840478897 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:30.840802908 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:30.840820074 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.056201935 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.056309938 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.060117960 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.060127020 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.060502052 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.061717987 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.061747074 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.061789989 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.804030895 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.804145098 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.804295063 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.804398060 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.804423094 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.804438114 CET	49731	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.804446936 CET	443	49731	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.825097084 CET	49732	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.825145006 CET	443	49732	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:32.825223923 CET	49732	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.825509071 CET	49732	443	192.168.2.4	104.21.66.86
Dec 28, 2024 22:04:32.825522900 CET	443	49732	104.21.66.86	192.168.2.4
Dec 28, 2024 22:04:33.556118965 CET	49732	443	192.168.2.4	104.21.66.86

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 22:04:25.580277920 CET	57277	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:25.811878920 CET	53	57277	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:25.816922903 CET	65153	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:26.033268929 CET	53	65153	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:26.036007881 CET	52835	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:26.262846947 CET	53	52835	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:26.265857935 CET	60362	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:26.538028002 CET	53	60362	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:26.540857077 CET	62739	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:26.767765999 CET	53	62739	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:26.770946980 CET	59004	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:27.054801941 CET	53	59004	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:27.056657076 CET	56101	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:27.279997110 CET	53	56101	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:27.287631989 CET	62404	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:27.520261049 CET	53	62404	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:27.558459044 CET	59981	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:27.868031979 CET	53	59981	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:27.871371984 CET	50267	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:28.008419037 CET	53	50267	1.1.1.1	192.168.2.4
Dec 28, 2024 22:04:30.515786886 CET	50914	53	192.168.2.4	1.1.1.1
Dec 28, 2024 22:04:30.839235067 CET	53	50914	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 22:04:25.580277920 CET	192.168.2.4	1.1.1.1	0xbb28	Standard query (0)	bellflamre.click	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:25.816922903 CET	192.168.2.4	1.1.1.1	0x5c6	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.036007881 CET	192.168.2.4	1.1.1.1	0xbbbd	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.265857935 CET	192.168.2.4	1.1.1.1	0x8954	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.540857077 CET	192.168.2.4	1.1.1.1	0x27bb	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.770946980 CET	192.168.2.4	1.1.1.1	0xd4a7	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.056657076 CET	192.168.2.4	1.1.1.1	0x9a14	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.287631989 CET	192.168.2.4	1.1.1.1	0x98c	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.558459044 CET	192.168.2.4	1.1.1.1	0x7fa1	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.871371984 CET	192.168.2.4	1.1.1.1	0xb625	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:30.515786886 CET	192.168.2.4	1.1.1.1	0x785f	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 22:04:25.811878920 CET	1.1.1.1	192.168.2.4	0xbb28	Name error (3)	bellflamre.click	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.033268929 CET	1.1.1.1	192.168.2.4	0x5c6	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.262846947 CET	1.1.1.1	192.168.2.4	0xbbbd	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.538028002 CET	1.1.1.1	192.168.2.4	0x8954	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:26.767765999 CET	1.1.1.1	192.168.2.4	0x27bb	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.054801941 CET	1.1.1.1	192.168.2.4	0xd4a7	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.279997110 CET	1.1.1.1	192.168.2.4	0x9a14	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.520261049 CET	1.1.1.1	192.168.2.4	0x98c	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:27.868031979 CET	1.1.1.1	192.168.2.4	0x7fa1	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:28.008419037 CET	1.1.1.1	192.168.2.4	0xb625	No error (0)	steamcommunity.com		104.121.10.34	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:30.839235067 CET	1.1.1.1	192.168.2.4	0x785f	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 28, 2024 22:04:30.839235067 CET	1.1.1.1	192.168.2.4	0x785f	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.121.10.34	443	4464	C:\Users\user\Desktop\Crosshair-X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:04:29 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 21:04:30 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 21:04:30 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=01822199e6c2252921d66452; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 21:04:30 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 21:04:30 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 21:04:30 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-28 21:04:30 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.66.86	443	4464	C:\Users\user\Desktop\Crosshair-X.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 21:04:32 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 21:04:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 21:04:32 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 21:04:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6p99rq68ovs6pfen7ul0hjtkjf; expires=Wed, 23 Apr 2025 14:51:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B9x7aFf5t1S5Cgaq0oXqAFRwglJmEEC9l8KBR52E9xcBDW3EIqqamIfw%2BNxwgBM0qXu%2F40IPu5l4aU8ep0C%2Bhu7pgGGOlv4DXuz0GHSPvccUxf5Q4yl3O5W%2Fy6o8vvAK760%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9480da1cf443bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2183&min_rtt=1576&rtt_var=1024&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1852791&cwnd=252&unsent_bytes=0&cid=e47bf10a746fd14a&ts=759&x=0"
2024-12-28 21:04:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 21:04:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:04:21
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Crosshair-X.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Crosshair-X.exe"
Imagebase:	0x840000
File size:	100'205'096 bytes
MD5 hash:	FFC5DBF6966DD3383FAEED15EAFEEEE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:04:21
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:04:23
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Crosshair-X.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Crosshair-X.exe"
Imagebase:	0x840000
File size:	100'205'096 bytes
MD5 hash:	FFC5DBF6966DD3383FAEED15EAFEEEE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	4.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 0087A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0087A110,0087A100), ref: 0087A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0087A347
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 0087A365
ReadProcessMemory.KERNELBASE(00000124,?,0087A154,00000004,00000000), ref: 0087A389
VirtualAllocEx.KERNELBASE(00000124,?,?,00003000,00000040), ref: 0087A3B4
WriteProcessMemory.KERNELBASE(00000124,00000000,?,?,00000000,?), ref: 0087A40C
WriteProcessMemory.KERNELBASE(00000124,00400000,?,?,00000000,?,00000028), ref: 0087A457
WriteProcessMemory.KERNELBASE(00000124,?,?,00000004,00000000), ref: 0087A495
Wow64SetThreadContext.KERNEL32(000000A0,005E0000), ref: 0087A4D1
ResumeThread.KERNELBASE(000000A0), ref: 0087A4E0

Strings

ResumeThread, xrefs: 0087A2D8
VirtualAlloc, xrefs: 0087A263
WriteProcessMemory, xrefs: 0087A2AF
VirtualAllocEx, xrefs: 0087A29C
aryA, xrefs: 0087A1E2
GetP, xrefs: 0087A21E
GetThreadContext, xrefs: 0087A276
ReadProcessMemory, xrefs: 0087A289
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0087A333
Load, xrefs: 0087A1DA
SetThreadContext, xrefs: 0087A2C2
CreateProcessW, xrefs: 0087A250
TerminateProcess, xrefs: 0087A3C3
ress, xrefs: 0087A226

Memory Dump Source

Source File: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: dfb932ceccc77431532897d83e59d28526b9688816c99e4ebe27e90727cdfa21
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 72B1E57660024AAFDB60CF68CC80BDA73A5FF88714F158124EA0CEB345D774FA518B94

Function 00841FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00841240: _strlen.LIBCMT ref: 008412BA

CreateFileA.KERNELBASE ref: 00842036
GetFileSize.KERNEL32(00000000,00000000), ref: 00842046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0084206B
CloseHandle.KERNELBASE(00000000), ref: 0084207A
_strlen.LIBCMT ref: 008420CD
CloseHandle.KERNEL32(00000000), ref: 008421FD

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: e7c0101e49155938163f93930f22cdd870b2fe0da522d618ac686a940948dcfe
Instruction ID: a4fc5ff9d234a93be40b4863e01e162a9465dcac43f0f6058a07f635875a0097
Opcode Fuzzy Hash: e7c0101e49155938163f93930f22cdd870b2fe0da522d618ac686a940948dcfe
Instruction Fuzzy Hash: 7671D2B2C006189BCB10DFA8DC487AEBBB5FF58314F140629F814E7391E775A945CBA1

Function 00841000 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9c26692b57af5772e74c8f17bd09b00515b93fdaae5cf09825b6191cdbf71b
Instruction ID: fc94b3d6eec3d9e998e3f3c32a7c9dbff51fbd695914929a8af8df3f64e1dd3c
Opcode Fuzzy Hash: 8a9c26692b57af5772e74c8f17bd09b00515b93fdaae5cf09825b6191cdbf71b
Instruction Fuzzy Hash: 1A215A3361056D0B8B9C9F3C6CA6037FB4AFB866A0705573AED12DF2C1E620DD9082E4

Function 008424B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 008424DD
ShowWindow.USER32(00000000,00000000), ref: 008424E6
GetCurrentThreadId.KERNEL32 ref: 00842524

Part of subcall function 0084F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0084253A,?,?,00000000), ref: 0084F129
Part of subcall function 0084F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0084253A,?,?,00000000), ref: 0084F142
Part of subcall function 0084F11D: CloseHandle.KERNEL32(?,?,?,0084253A,?,?,00000000), ref: 0084F154

std::_Throw_Cpp_error.LIBCPMT ref: 00842567
std::_Throw_Cpp_error.LIBCPMT ref: 00842578
std::_Throw_Cpp_error.LIBCPMT ref: 00842589
std::_Throw_Cpp_error.LIBCPMT ref: 0084259A

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: e676119009f2b08a2ef32f6970db2497a09a3baccc9a2ec6b969b584af472057
Instruction ID: f8511f5c5e5a0dcae8641e89337dd6ff003e0cca403118cfd33b0e745babe19a
Opcode Fuzzy Hash: e676119009f2b08a2ef32f6970db2497a09a3baccc9a2ec6b969b584af472057
Instruction Fuzzy Hash: 022165F2D402199BDF50AF989C06BDEBAB8FF04710F080125F508BA281E7B69554CAA6

Function 0085CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,1D994CD9,?,0085D01A,?,?,00000000), ref: 0085CFCC

Strings

api-ms-, xrefs: 0085CF62
ext-ms-, xrefs: 0085CF76

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ee2dd7927d2b69e597809ce3356e04a1992367e3fd8a2fad44404c7c3224fa0f
Instruction ID: 7741afd81dbcc9bc415d88d1889869411c33fc860d0bfc8b6b5f99148347a4d2
Opcode Fuzzy Hash: ee2dd7927d2b69e597809ce3356e04a1992367e3fd8a2fad44404c7c3224fa0f
Instruction Fuzzy Hash: 5F210531A01711AFC7328B64DC44A5A7B6AFF81765F250111ED4AE7290EFB0ED18CED0

Function 00841750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00841783

Strings

ios_base::failbit set, xrefs: 00841BEF
ios_base::eofbit set, xrefs: 00841BEA
ios_base::badbit set, xrefs: 00841BFA, 00841C20

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 4bf595a20f04a3e9d9fcaf53d315e2c5fd1d27dda8c28990d9925e1689b7f27d
Instruction ID: d16e7a31855a8b84a29d661e73eac7f0de690743ebe7f775972d55d5bd27a13e
Opcode Fuzzy Hash: 4bf595a20f04a3e9d9fcaf53d315e2c5fd1d27dda8c28990d9925e1689b7f27d
Instruction Fuzzy Hash: DBF13B75A006188FCF14CF68C498BADBBF1FF88324F194269E819AB395D774AD45CB90

Function 00855349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 00855392
GetLastError.KERNEL32(?,?,?,00842513,00000000,00000000), ref: 0085539E
__dosmaperr.LIBCMT ref: 008553A5

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 1cf12cc0a2705bd3127a50d5206f4eeb75084b8d8868f8bb69ffb29e7c673e50
Instruction ID: b1430f33ce079a093ad1ac3fb90c7d2455531cfe42b440d032608be427035f1a
Opcode Fuzzy Hash: 1cf12cc0a2705bd3127a50d5206f4eeb75084b8d8868f8bb69ffb29e7c673e50
Instruction Fuzzy Hash: 5E019272505619EBDF159FA4DC25AEE7B64FF01392F108058FC05D2250EBB0D958DB51

Function 008554EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0085C2BB: GetLastError.KERNEL32(00000000,?,008576E9,0085D306,?,?,0085C1B7,00000001,00000364,?,00000005,000000FF,?,00855495,00878E38,0000000C), ref: 0085C2BF
Part of subcall function 0085C2BB: SetLastError.KERNEL32(00000000), ref: 0085C361

CloseHandle.KERNEL32(?,?,?,008553D9,?,?,008554CE,00000000), ref: 0085551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,008553D9,?,?,008554CE,00000000), ref: 00855535
ExitThread.KERNEL32 ref: 0085553E

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: c75f472531f094efe9977ea21ec95a7e2151db06416ed02fc2b49b96d26a0191
Instruction ID: 3e8329ae04b408f292700aee986663b35cfcaaebf2bfeaaa8afc260135ef77f3
Opcode Fuzzy Hash: c75f472531f094efe9977ea21ec95a7e2151db06416ed02fc2b49b96d26a0191
Instruction Fuzzy Hash: B4F05E70100F016BDB215B79D85CA1A3B9AFF40372B094614FC69C70A0FB20DD5ACB51

Function 0085565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00855721,00858396,00858396,?,00000002,1D994CD9,00858396,00000002), ref: 00855670
TerminateProcess.KERNEL32(00000000,?,00855721,00858396,00858396,?,00000002,1D994CD9,00858396,00000002), ref: 00855677
ExitProcess.KERNEL32 ref: 00855689

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2e0d7e8a4ad579a572b28ba88efd3b9aae0e3754978eecac980e955f91559e77
Instruction ID: 3bc6edebbbc4f0aeb686b3969de0c1ed9fc30c941221cf5fc6688a04c0b81098
Opcode Fuzzy Hash: 2e0d7e8a4ad579a572b28ba88efd3b9aae0e3754978eecac980e955f91559e77
Instruction Fuzzy Hash: F2D06731000944ABCF122F65DC5D8593F6AFB503427444010B94989066EF32D9A9DA45

Function 00863BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00863F9E: GetConsoleOutputCP.KERNEL32(1D994CD9,00000000,00000000,?), ref: 00864001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00858584,?), ref: 00863D79
GetLastError.KERNEL32(?,?,00858584,?,008587C8,00000000,?,00000000,008587C8,?,?,?,00878FE8,0000002C,008586B4,?), ref: 00863D83

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 23722f9721f55101bd1611c5e6ca17349236a3625bc01812e7a17ff72b402d6a
Instruction ID: da803907b0811afb095a6d079c02d4d6e56ed0020102f49c7c74035caaf94af3
Opcode Fuzzy Hash: 23722f9721f55101bd1611c5e6ca17349236a3625bc01812e7a17ff72b402d6a
Instruction Fuzzy Hash: 46619D71904219AEDF11CFA8D885AAEBFB9FF49308F160149F804F7256D732DA11CBA1

Function 008643CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00863D5F,00000000,008587C8,?,00000000,?,00000000), ref: 00864469
GetLastError.KERNEL32(?,00863D5F,00000000,008587C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00858584), ref: 0086448F

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: ac87fe9e23554de2e3a7ce23a175f49a478f220be2934578bd9f316d4597795a
Instruction ID: 6d83a1b69a5c3a3d68262e86eaa9b53f856bec22dab017748384f3f0a0564f1d
Opcode Fuzzy Hash: ac87fe9e23554de2e3a7ce23a175f49a478f220be2934578bd9f316d4597795a
Instruction Fuzzy Hash: 6321A030A012189BCB19CF19DC81AEDB7B9FB48305F1540A9E90AD7211DA30DD82CB64

Function 008490F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 008491C9
std::_Throw_Cpp_error.LIBCPMT ref: 008491D7

Part of subcall function 0084EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00848E4A,0084A2F0), ref: 0084EFE7

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: e32e3a89ef4b5c5bf94afc913832516e9d994f569ff699fc9bbe42ccea64a98d
Instruction ID: cb098fc2a19fe7c1bac22d7465497a9e5d393fa49ef48ede815ecc49435d781d
Opcode Fuzzy Hash: e32e3a89ef4b5c5bf94afc913832516e9d994f569ff699fc9bbe42ccea64a98d
Instruction Fuzzy Hash: 8D2105B090064ADBDB20DF68CD45BAEBBB4FF04320F144228E565973C1D734A904CBD2

Function 0085DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0085D941,00879330,0000000C), ref: 0085DA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0085D941,00879330,0000000C), ref: 0085DAB0

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 1e419945df68af05354e72972f3c5a40f36456b712f60e5d092d2f88e1325a28
Instruction ID: d5542784ee40d146936ce4538807ec92f1c11f0fc1f9045484b22ef24a717b1f
Opcode Fuzzy Hash: 1e419945df68af05354e72972f3c5a40f36456b712f60e5d092d2f88e1325a28
Instruction Fuzzy Hash: 3A11B771108B624AC7328A3E8C886237A95FB96336B380759DCBAD65F5C670D88ED600

Function 00841EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00841240: _strlen.LIBCMT ref: 008412BA

FreeConsole.KERNELBASE(?,?,?,?,?,0084173F,?,?,?,00000000,?), ref: 00841F21
VirtualProtect.KERNELBASE(0087A011,00000549,00000040,?), ref: 00841F78

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: aa731af8883c92428867d2ad6f876da8d8901a623d78d00e3193a34fa462b888
Instruction ID: 801f6da1e072d1d1c64c4358cdf4502e7e06bb07126729ef6a5758207266e553
Opcode Fuzzy Hash: aa731af8883c92428867d2ad6f876da8d8901a623d78d00e3193a34fa462b888
Instruction Fuzzy Hash: D611E771B00108ABDF04BB64DC06EBF7764FB84700F004429F618E7282E675D59047D6

Function 00855470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00878E38,0000000C), ref: 00855483
ExitThread.KERNEL32 ref: 0085548A

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: ef1e84538e516b4cde3424ddadfe1ba6f459887337d1723b03e85d247c7dcd0b
Instruction ID: 72f44f010cb1b68954293151061d09afa8a9f37cfb5ac1bd46d07d0e209a544d
Opcode Fuzzy Hash: ef1e84538e516b4cde3424ddadfe1ba6f459887337d1723b03e85d247c7dcd0b
Instruction Fuzzy Hash: 25F0C271A40B049FDB11AF74C80AA6E7B70FF40712F104459F80AD7292DF74A985CB52

Function 00842270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00842288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0084229C

Part of subcall function 00841FB0: CreateFileA.KERNELBASE ref: 00842036
Part of subcall function 00841FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 00842046
Part of subcall function 00841FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0084206B
Part of subcall function 00841FB0: CloseHandle.KERNELBASE(00000000), ref: 0084207A
Part of subcall function 00841FB0: _strlen.LIBCMT ref: 008420CD

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: 6c4dde9b0162d503c423eb64eaa31f8c953fdbabb366e2b093c79e89cff0e277
Instruction ID: 4f3632ca067173f8e5abd369267c7f22b527c5148dca23d72e3242d85c7f13d4
Opcode Fuzzy Hash: 6c4dde9b0162d503c423eb64eaa31f8c953fdbabb366e2b093c79e89cff0e277
Instruction Fuzzy Hash: 9AF0E5B1A052102BD5257728BC4FFAB7BACEF95710F000514F58D8A185FA7491958AD3

Function 0085BED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,008602B4,?,00000000,?,?,0085FF54,?,00000007,?,?,0086089A,?,?), ref: 0085BEED
GetLastError.KERNEL32(?,?,008602B4,?,00000000,?,?,0085FF54,?,00000007,?,?,0086089A,?,?), ref: 0085BEF8

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 923d2a4eeaf376d0a48d66867ea41eb8cb7d823d1d9421d9467def977cb44556
Instruction ID: abab2e46bfc92cdbf05d6bc331a305a268705c0d80de2f716283113c27f3b5ac
Opcode Fuzzy Hash: 923d2a4eeaf376d0a48d66867ea41eb8cb7d823d1d9421d9467def977cb44556
Instruction Fuzzy Hash: 0CE08631104A1467CF212FA8FC0CB553BA8FB50392F108011FA0CD6174DB31C994CB94

Function 0084DEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae920beae5daaeda838a08cb3fef3fbdbcf747b08fe9f0cbfdeef4b0d3238f7f
Instruction ID: b721724716b6065b920a5cf6ed05534563a8c4da8c188d8e2345d515a433d5dc
Opcode Fuzzy Hash: ae920beae5daaeda838a08cb3fef3fbdbcf747b08fe9f0cbfdeef4b0d3238f7f
Instruction Fuzzy Hash: D441AE31A0061EAFCB14DF68D8949EDB7F9FF18314F54406AE446E7640EB31E945DB90

Function 0084CB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796eecdbb3b7e572ef8f3137f2d43cd3ede5fab9657a6634e8f199f96429f4f2
Instruction ID: 72dc178d43374f145ac0087d3585b6b9d061b9207be208ff65e61d908d2594db
Opcode Fuzzy Hash: 796eecdbb3b7e572ef8f3137f2d43cd3ede5fab9657a6634e8f199f96429f4f2
Instruction Fuzzy Hash: F231927290121EAFCF54CF68D8909EEB7BCFF09324B14026AE516E3290E731E954DB90

Function 0084B060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0084AFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,00848A2A,?,?,0084AF87,00848A2A,?,0084AF58,00848A2A,?,?,?), ref: 0084AFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,1D994CD9,?,?,?,Function_0002BE94,000000FF), ref: 0084B0C7

Part of subcall function 0084AEFA: std::_Throw_Cpp_error.LIBCPMT ref: 0084AF1B

Part of subcall function 0084EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00848E4A,0084A2F0), ref: 0084EFE7

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: a59d22835eab98effd221ece5191cf614545a90171497f9290a7ab6b855a0c0a
Instruction ID: f391f300175992ec9e6a444e74c56e5f2a160f59d1a2e6a823badcf227b0eff7
Opcode Fuzzy Hash: a59d22835eab98effd221ece5191cf614545a90171497f9290a7ab6b855a0c0a
Instruction Fuzzy Hash: 2E110432644A48ABCB296B6D9C16A2E7BAAFB40B20F00441EF419CB6D0CF35D840DA42

Function 0085CFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95efc19441f73221fae88bf3e94b4b73e8d0647515c366f0a02c74614e90332
Instruction ID: 4fef3af3983cfbd7f4e454505e282284684e36bf7332cfc1aef9b53cd1d04a40
Opcode Fuzzy Hash: e95efc19441f73221fae88bf3e94b4b73e8d0647515c366f0a02c74614e90332
Instruction Fuzzy Hash: 800128332007185F9B269F68EC84A2633A6FBC0762F254024FE08DB1D8EB31D846D751

Function 0084CB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: cf3100c6b11f3783c1e90d720c5effe0ca0e63f560ff38e5806c99cb7e835411
Instruction ID: a2fbff0f8ed490ca93d618aed2537a4545a1cba5515f4566fd354ac48e686710
Opcode Fuzzy Hash: cf3100c6b11f3783c1e90d720c5effe0ca0e63f560ff38e5806c99cb7e835411
Instruction Fuzzy Hash: 0801447660A28E5ECF859B7CF9652A8BB14FF95338B20816FD111C45D1DB129814D701

Function 00847770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 008477C6

Part of subcall function 0084AF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,008478DA,00000000), ref: 0084AF72

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: a882657e30b7b2177f186e625bb46a794a27c81ebc47751dd18a768fff642409
Instruction ID: 40aa241be6bb3b959bba525ee1db2fb7f5b3614c6bdda152f6f1d7863c046b66
Opcode Fuzzy Hash: a882657e30b7b2177f186e625bb46a794a27c81ebc47751dd18a768fff642409
Instruction Fuzzy Hash: 72018BB1C006599BDB04EF88DC0579EFBB4FB04720F004239E8196B340E379AA85CBD2

Function 0085BF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0085DF35,?,?,0085DF35,00000220,?,00000000,?), ref: 0085BF43

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1acd3e54a7978ab113abf832f25768d409556adbd2146b8375acf3e1a380ca04
Instruction ID: f684021296be062d5e0d43533ca8ab118392e5e3cd111ede3672fb762f802331
Opcode Fuzzy Hash: 1acd3e54a7978ab113abf832f25768d409556adbd2146b8375acf3e1a380ca04
Instruction Fuzzy Hash: 53E0ED35205A2166DB202A6AAC04B5B3A88FF61BB3F140061EC1CE6190DF20DC08C9A2

Function 008498F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0084990F

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6e3e421c4a8cfb1fba3bac4654965bc611b1aad92e2afce1b011616369e8c995
Instruction ID: 1e37b6c52e9bec0c16f177d838881a50d93d83a633581c84fd507718ee897b45
Opcode Fuzzy Hash: 6e3e421c4a8cfb1fba3bac4654965bc611b1aad92e2afce1b011616369e8c995
Instruction Fuzzy Hash: 2FD0A7397054284F4714BF2CA81892EB752FFC872035644AAE944D734AD724DC4287C0

Non-executed Functions

Function 00867792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008679A9

Strings

1#INF, xrefs: 008678C8
1#SNAN, xrefs: 0086789E
1#QNAN, xrefs: 008678A5
1#IND, xrefs: 00867897

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c528422ecd26948c48bb03c3b12e555c406f769507fef14af3c44704da264259
Instruction ID: c51fcf4efa68cd108026a5079925368a99d7be4942047d396388d521af51b4c2
Opcode Fuzzy Hash: c528422ecd26948c48bb03c3b12e555c406f769507fef14af3c44704da264259
Instruction Fuzzy Hash: 9ED21871E082298FDB65CE28DD44BEAB7B5FB44305F1542EAD80DE7240DB74AE858F81

Function 00861A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,008613BD,00000002,00000000,?,?,?,008613BD,?,00000000), ref: 00861AA0
GetLocaleInfoW.KERNEL32(?,20001004,008613BD,00000002,00000000,?,?,?,008613BD,?,00000000), ref: 00861AC9
GetACP.KERNEL32(?,?,008613BD,?,00000000), ref: 00861ADE

Strings

ACP, xrefs: 00861A25
OCP, xrefs: 00861A5B

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0d477d2624081a92ac096f61804047db67a930863875a500049795a168443f84
Instruction ID: f65857f251883a924d1387aced5cd338a663dd1892d36a066156d165a46315ab
Opcode Fuzzy Hash: 0d477d2624081a92ac096f61804047db67a930863875a500049795a168443f84
Instruction Fuzzy Hash: 6521B822B0212597DF35CFE4D908A9B72A7FB50B56B5F8464E909DB206F731DD40D350

Function 00861287 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0086138F
IsValidCodePage.KERNEL32(00000000), ref: 008613CD
IsValidLocale.KERNEL32(?,00000001), ref: 008613E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00861428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00861443

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 82654dc01d73f4f168012be0a00132bb9a194ac869a370bb2149754c340326fb
Instruction ID: 442fd1963ee6f6ac18c7cd0f20fc7e4fa2cc5c158598249f0100f768cdeafd06
Opcode Fuzzy Hash: 82654dc01d73f4f168012be0a00132bb9a194ac869a370bb2149754c340326fb
Instruction Fuzzy Hash: 5A518071A00209AFDF10DFA5CD49EBE77B8FF04704F1A4465E905EB292EB74DA448B61

Function 00859CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 9434f1657a387772096ad8682b62515607f66e190fd8a50a5503cccef071801b
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 73024C71E00619DBDF14CFA9C8806AEBBB1FF48315F24826AD919E7380D731A945CB91

Function 00861FE9 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 008620D9
FindNextFileW.KERNEL32(00000000,?), ref: 008621CD
FindClose.KERNEL32(00000000), ref: 0086220C
FindClose.KERNEL32(00000000), ref: 0086223F

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 0c586dec0c3da5733fabffc43feaa0e5ca8a6bcca553921a7a1319bd17331dea
Instruction ID: 5a3c6fc49ae5b72ec4091bbc7e215a21aed8177579bac9bca07436ec7723b08f
Opcode Fuzzy Hash: 0c586dec0c3da5733fabffc43feaa0e5ca8a6bcca553921a7a1319bd17331dea
Instruction Fuzzy Hash: D37111B19059689FCF21AF388C9DABAB7B9FB05300F1941D9E548E7211EB308E848F51

Function 0084F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0084F8F5
IsDebuggerPresent.KERNEL32 ref: 0084F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0084F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0084F9E4

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 85134143be01593dc9063b9829cbd3131b99dd0c3ff03f099780f7ccd91d353a
Instruction ID: e93d1e7a9d948359ec88d9b8db3f821a8a1f08d62556f23c935ba55203227976
Opcode Fuzzy Hash: 85134143be01593dc9063b9829cbd3131b99dd0c3ff03f099780f7ccd91d353a
Instruction Fuzzy Hash: 5E31E3B5D0121DAADF21DFA5D9497CDBBB8FF08300F1041AAE50DAB251EB719A848F45

Function 00861580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008615D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0086161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008616E4

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 2c2d158ffc26776fbfeb16ce0ffec0a6da6d5a9da057362fe4c42e0eb9702cd7
Instruction ID: 112b10b4b41c327e12167e7b558b1bb20211ca4d610ffc42a16b0fa0964dc400
Opcode Fuzzy Hash: 2c2d158ffc26776fbfeb16ce0ffec0a6da6d5a9da057362fe4c42e0eb9702cd7
Instruction Fuzzy Hash: AB61AF716002079FDF289F28CD8ABBA73A9FF14701F2941B9ED05C658AE734D994DB50

Function 00857E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00857F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00857F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00857F3F

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 78a9d5c21754fafe970ed97ca322f6628e872025243e949fb03e832cb848a475
Instruction ID: f6affc6696c5e5f50bd795bd9b4faa3b542f8f5eb5ef3930313cedd6073cb755
Opcode Fuzzy Hash: 78a9d5c21754fafe970ed97ca322f6628e872025243e949fb03e832cb848a475
Instruction Fuzzy Hash: 8831B17491122CABCB21DF68D88978DBBB8FF18311F5041EAE80CA7251EB709F858F45

Function 008500B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 008500EC
GetSystemTimeAsFileTime.KERNEL32(?,1D994CD9,00848E30,?,0086BE77,000000FF,?,0084FDB4,?,00000000,00000000,?,0084FDD8,?,00848E30,?), ref: 008500F0

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 6ee0a0eeaa56243636364a833b405af1e60a6c4a29e37fe610dc66f0d27309dd
Instruction ID: f5fc8973dc2bf1cff8120795e389e6383cb0c7f8f9e5cbaa7cc88353a07c45ff
Opcode Fuzzy Hash: 6ee0a0eeaa56243636364a833b405af1e60a6c4a29e37fe610dc66f0d27309dd
Instruction Fuzzy Hash: 91F06532A48A58EFC7119F44DC44B5EBBA8FB08B14F01013AED16D3794DB75E940DB80

Function 00865C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00865BB9,?,?,00000008,?,?,0086BCAB,00000000), ref: 00865E8B

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c3672fb08d1b8c45492166e8389f94b378f6c43c5897bb9e15daf5cb2959b26b
Instruction ID: dd6406f1b8fae40719f311c82dc8599a8a7546894dc4eb26940a85d945ff5792
Opcode Fuzzy Hash: c3672fb08d1b8c45492166e8389f94b378f6c43c5897bb9e15daf5cb2959b26b
Instruction Fuzzy Hash: D6B15031510A09DFDB15CF28C48AB657BE0FF45364F2A8658E899CF2E1C736EA91CB40

Function 0084F555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0084F56B

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 15418d85d4f748f28363ad0f74e4f2ae50502523e0da8b772a5f32588d6b47c2
Instruction ID: ff7ec29b07968043fc6d2e306cf56f538195f84dea1e3ed7bf3f45edcabdedba
Opcode Fuzzy Hash: 15418d85d4f748f28363ad0f74e4f2ae50502523e0da8b772a5f32588d6b47c2
Instruction Fuzzy Hash: 0BA19E729106098BDB18CF54D889799BBF6FB483A4F24813ED529EB369C374D980CF51

Function 00861840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00861894

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: f2e213ce800514d8775a9ec5c6d84d7af8a4616910d7447a9b93b4c4d47634db
Instruction ID: b533b213ab87437b20049883ef63b184baf599535d4e249b834249ea4fd3913f
Opcode Fuzzy Hash: f2e213ce800514d8775a9ec5c6d84d7af8a4616910d7447a9b93b4c4d47634db
Instruction Fuzzy Hash: 3321F232610206AFDF289B29DC45ABA37A8FF54711F15007AFD02C7142EB34ED44CB51

Function 00853FB2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00854136

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e5ab54e77a1aea52485c51baae57cbacdbaa0536e08a06d713fe49d34a2c18e8
Instruction ID: 1e8e25fa11c3d4a978a5feacc4529e50b9b55203c63e80ce4ba79d7b5f1c4349
Opcode Fuzzy Hash: e5ab54e77a1aea52485c51baae57cbacdbaa0536e08a06d713fe49d34a2c18e8
Instruction Fuzzy Hash: 25B1D330900A1A8BCB68CE68C9556BEBBB1FB0130EF24661DEE56D7681C77199CDCB41

Function 008614D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

EnumSystemLocalesW.KERNEL32(00861580,00000001,00000000,?,-00000050,?,00861363,00000000,-00000002,00000000,?,00000055,?), ref: 0086154A

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7fbdd3b91966448f6a9d8e5f946f9313b48bb1b5cc28c5784d712f2dfb07d125
Instruction ID: 2678e0cb11aba67cafd18f5891f7c62d82bb65e016d145fe8cb1076f238cb686
Opcode Fuzzy Hash: 7fbdd3b91966448f6a9d8e5f946f9313b48bb1b5cc28c5784d712f2dfb07d125
Instruction Fuzzy Hash: 7011C6362007015FDF189F3988995BAB791FB80768B19442DE947C7B41E771A942C740

Function 00861960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 008619B4

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 34f95b64ae8d8227747cb23c06595aa3ebbdadeabdf167499a8256fe709a1aff
Instruction ID: 34144dd21b68dc7946bcdd6a43bdd2fa4d623c933999b892fd3ecc8bfed9c278
Opcode Fuzzy Hash: 34f95b64ae8d8227747cb23c06595aa3ebbdadeabdf167499a8256fe709a1aff
Instruction Fuzzy Hash: 93110232610206ABDB14AF68DC5AABB7BECFF04720B55417AF902C7142EB38ED449B51

Function 00861B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0086179C,00000000,00000000,?), ref: 00861B39

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bdd3f4db8c5228891a32057e0b6fbb1d67900c071a27d3438c60cd0628a01b9a
Instruction ID: d6dd7d7ad0d714a4660f4df44064e3f65a2396cf60206451a64351e337321217
Opcode Fuzzy Hash: bdd3f4db8c5228891a32057e0b6fbb1d67900c071a27d3438c60cd0628a01b9a
Instruction Fuzzy Hash: D201D632610116ABDF285B658C0DAFA3768FB40768F1A4468EE06E3581FA70EE41C790

Function 008617D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

EnumSystemLocalesW.KERNEL32(00861840,00000001,?,?,-00000050,?,0086132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0086181D

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 94c988edd7cee8549ef04c2107d43566b69ece643ca3b14dd1beda2d24a46c9f
Instruction ID: a6359f05c4b3eb3bf6a18bfe1834f426b8da6924c4716d82899c1da8a336f14c
Opcode Fuzzy Hash: 94c988edd7cee8549ef04c2107d43566b69ece643ca3b14dd1beda2d24a46c9f
Instruction Fuzzy Hash: BEF0C2362003045FDF255F79D889A6A7B91FF81768B1A843CF945CB692D6B19C42C650

Function 0085D1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008580E1: EnterCriticalSection.KERNEL32(?,?,0085C5F8,?,00879290,00000008,0085C4EA,?,?,?), ref: 008580F0

EnumSystemLocalesW.KERNEL32(0085D1B0,00000001,00879310,0000000C,0085CB11,-00000050), ref: 0085D1F5

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: bec0837247e137fc8534d56a2255723fd661de2e9dc786787bd6b835e95cf74c
Instruction ID: 93fd478b91bf63d3734ecbf033a71cb8d58d6f076230a01a6027e8f5677de9de
Opcode Fuzzy Hash: bec0837247e137fc8534d56a2255723fd661de2e9dc786787bd6b835e95cf74c
Instruction Fuzzy Hash: 83F01972A40704DFDB10EFA8E846B5977F0FB45726F10802AF918DB3A0DA7599848F41

Function 00861915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

EnumSystemLocalesW.KERNEL32(00861960,00000001,?,?,?,00861385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0086194C

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4e1cd64180b3e1a08e831a210cac5799d8777a297051b17a30dea0e5ad8bf3bc
Instruction ID: 2c689573151f0d25f638b9a1522143186aee915548c15456b16fcf2550ed58f6
Opcode Fuzzy Hash: 4e1cd64180b3e1a08e831a210cac5799d8777a297051b17a30dea0e5ad8bf3bc
Instruction Fuzzy Hash: 08F0EC3530030557CF059F39DC69666BFA4FFC1B51F5B4058EA09CB651C6759882C790

Function 0085CC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00856E33,?,20001004,00000000,00000002,?,?,00855D3D), ref: 0085CC49

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 74821c8c2abba51aaf4118dced586bfb6dc465660fb20aeecc3ff4e28aa345c8
Instruction ID: 8760f074736fedf5d5857c1ad6094052a37df3b933671ecf4cc80c1e6c4ea1e6
Opcode Fuzzy Hash: 74821c8c2abba51aaf4118dced586bfb6dc465660fb20aeecc3ff4e28aa345c8
Instruction Fuzzy Hash: C7E04F3550072CBFCF222F64ED08E9E7E26FF44B52F044021FD09A6165CB318D65AB91

Function 0084F8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 0084F8E2

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ecaaf4213f38b23fd2303395328f7d5c717579ec6d86c1280d0fc5dab310294
Instruction ID: c5549a232b3d3d19bbcffcf978646a5bac1bf435189a3ef830ae133f2eb25dd9
Opcode Fuzzy Hash: 2ecaaf4213f38b23fd2303395328f7d5c717579ec6d86c1280d0fc5dab310294
Instruction Fuzzy Hash:

Function 0085D8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0085D8E0

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 38a33a36a66b76f5b95c0fff87ca229c0ca4851074e8b896b4d541ba4c28e78a
Instruction ID: 513542a1aa3967ce410b320a05a69ed4583298517e68b376de5fb766038f1246
Opcode Fuzzy Hash: 38a33a36a66b76f5b95c0fff87ca229c0ca4851074e8b896b4d541ba4c28e78a
Instruction Fuzzy Hash: FBA011302003028BA3008F32AA0C2083AA8BA80AC0B00C028A808C2028EA30C0A0AF08

Function 0086AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,0086AACD,?,?,?,?,?,?,?,?,?), ref: 0086AB88
__alloca_probe_16.LIBCMT ref: 0086AC43
__alloca_probe_16.LIBCMT ref: 0086ACD2
__freea.LIBCMT ref: 0086AD1D
__freea.LIBCMT ref: 0086AD23
__freea.LIBCMT ref: 0086AD59
__freea.LIBCMT ref: 0086AD5F
__freea.LIBCMT ref: 0086AD6F

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 9e90af216ea03829b75e3c5b610120fb989df9efffd49569696334b6ecff83b7
Instruction ID: 8e0b55463e6248a38277106ee54ee0b0350ba9ebb4e56873f02078d3a519e7b1
Opcode Fuzzy Hash: 9e90af216ea03829b75e3c5b610120fb989df9efffd49569696334b6ecff83b7
Instruction Fuzzy Hash: F571D5729002095BDF299E588C82FAF77AAFF45311F2A0459E904F7292E735DC408F62

Function 0084FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0084FE70
__alloca_probe_16.LIBCMT ref: 0084FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0084FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0084FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0084FF37
__alloca_probe_16.LIBCMT ref: 0084FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0084FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0084FFB9

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: dabbc6a59a75c8ff5a77da1d0a5d5dbe0431109648e13674a2186b9f558bc5b7
Instruction ID: 7565c1599bb706a61ffa3fb40e5cce57130087cbc98db01700f48b60f0a0a794
Opcode Fuzzy Hash: dabbc6a59a75c8ff5a77da1d0a5d5dbe0431109648e13674a2186b9f558bc5b7
Instruction Fuzzy Hash: 3051AC7260061EAFEB204F64CC45FAA7AA9FF41754F14443AFA15DA192EF31DC148B50

Function 0085EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0085EEFC

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: ffd80e9ee20b2a9fb9c11de681e34130eb2cfed883c18e532ea14b5d668ce91b
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: CCB15672A006559FDB168F28CC81BAE7BA6FF15311F1841A5EE44EB283D7709909C7A1

Function 00850D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00850D77
___except_validate_context_record.LIBVCRUNTIME ref: 00850D7F
_ValidateLocalCookies.LIBCMT ref: 00850E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00850E33
_ValidateLocalCookies.LIBCMT ref: 00850E88

Strings

csm, xrefs: 00850E1D

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 791a455f46ffc0619c52e3fba15eb0bc644bad4a494859e180efee6b93635e0a
Instruction ID: 8394991d1e9810481efe7d32f85de05158384173395e63eef8bd0a6c7777d804
Opcode Fuzzy Hash: 791a455f46ffc0619c52e3fba15eb0bc644bad4a494859e180efee6b93635e0a
Instruction Fuzzy Hash: 0741BF34A0021C9BCB11DF68C886A9EBBB5FF44326F248555ED18EB352D731EA19CF91

Function 00850080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00850086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00850094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008500A5

Strings

GetTempPath2W, xrefs: 0085009A
GetSystemTimePreciseAsFileTime, xrefs: 0085008E
kernel32.dll, xrefs: 00850081

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 8ddf476b87f744c9096d092ba4cb82525907381bb3fe4a6ebaaaf14de3b064c7
Instruction ID: a1151405b8d3bba0d8d623cb5f3ba1806b8b4f433c149dc9397c29aba437d173
Opcode Fuzzy Hash: 8ddf476b87f744c9096d092ba4cb82525907381bb3fe4a6ebaaaf14de3b064c7
Instruction Fuzzy Hash: F6D05E31901610AB83116F747C0C8893EA8FB493003018056F41CE236CEFB4C6808A56

Function 00864F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978ae2eabcf3958217125d5ac2b2807efc0e6b45f63a8c6196a7a26329c5f528
Instruction ID: ec8b566f03af00234c07599887eecc08124a5f8de394b3053bf1926a9c5f8169
Opcode Fuzzy Hash: 978ae2eabcf3958217125d5ac2b2807efc0e6b45f63a8c6196a7a26329c5f528
Instruction Fuzzy Hash: 84B11370A08B49AFDB11CFACD895BAEBBB0FF56304F154158E904EB382C7719941CBA1

Function 00849B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00849C97
std::_Throw_Cpp_error.LIBCPMT ref: 00849CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00849CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00849CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00849CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00849D06

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 0d79655c0c9ff423635665d9957c9813654c8d18fd9e9771b03296f9cc85d337
Instruction ID: 87084ab2bfdff2e1d399b236652676e21c036c9dabf72edbbc2a99c9cad2f039
Opcode Fuzzy Hash: 0d79655c0c9ff423635665d9957c9813654c8d18fd9e9771b03296f9cc85d337
Instruction Fuzzy Hash: B441D3B1900748CBDB309F6989417ABBBF4FF45324F18062DD5BAA62D1D770A504CB93

Function 0085ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0085ACDE,00850760,0084B77F,1D994CD9,?,?,?,?,0086BFCA,000000FF), ref: 0085ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0085AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0085AD1C
SetLastError.KERNEL32(00000000,?,0085ACDE,00850760,0084B77F,1D994CD9,?,?,?,?,0086BFCA,000000FF), ref: 0085AD6E

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a43ef8e444d5dc5c14abb8a769aaf16e0d13f092558d365588f458eb6200bc59
Instruction ID: 6a94944a78c72d0ae4d9be77d329c3c9a7b13f5b52f7c72d804d4ba6a1d2f690
Opcode Fuzzy Hash: a43ef8e444d5dc5c14abb8a769aaf16e0d13f092558d365588f458eb6200bc59
Instruction Fuzzy Hash: 40016D322096199DA72836787CC9A262E99FF00B77724033AFE24C21F0FF118C475142

Function 0085B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0085B68D
CallUnexpected.LIBVCRUNTIME ref: 0085B906

Strings

csm, xrefs: 0085B5AB
csm, xrefs: 0085B6C4
csm, xrefs: 0085B618

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: ac557b962efd06785cb3680fe4ecb552032769fddbd842ba8e08d54f3d11084c
Instruction ID: 4f11c0ed463ec0917201e8b132d15928015408b1479def2b393cc6b5e1035965
Opcode Fuzzy Hash: ac557b962efd06785cb3680fe4ecb552032769fddbd842ba8e08d54f3d11084c
Instruction Fuzzy Hash: C0B16F75800209EFCF19DFA8C8819AEBBB5FF24312F144569EC11AB212D731D959DF92

Function 0084BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0084BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0084C028

Strings

MOC, xrefs: 0084BE9F
RCC, xrefs: 0084BEAB
csm, xrefs: 0084BEB7

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: 3bc8cf35d10f5a9cb4d9035f5866d5f8b574bfc119402af4b0753277c82b0f77
Instruction ID: 2364f2b7f6480c62394ea54379989a67db7c0755fdc40f06a14248d2f602f8ef
Opcode Fuzzy Hash: 3bc8cf35d10f5a9cb4d9035f5866d5f8b574bfc119402af4b0753277c82b0f77
Instruction Fuzzy Hash: EF41C934901208DFCF28DF68C9419AEB7B9FF58300B5880ADE449E7642CB34EA08CB52

Function 008555C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1D994CD9,?,?,00000000,0086BE94,000000FF,?,00855685,00000002,?,00855721,00858396), ref: 008555F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0085560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0086BE94,000000FF,?,00855685,00000002,?,00855721,00858396), ref: 0085562D

Strings

mscoree.dll, xrefs: 008555F2
CorExitProcess, xrefs: 00855603

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 53d2289de237f6142a500a2b1413ccfc2e9cc84a31f5377a07263111a7faafe2
Instruction ID: 1882ae83fdef3183f2442d3d42dc118c16f96c0c2a909b7cc11b6dd07e45e09e
Opcode Fuzzy Hash: 53d2289de237f6142a500a2b1413ccfc2e9cc84a31f5377a07263111a7faafe2
Instruction Fuzzy Hash: C701DB31A00A55AFDB128F44CC09BAEB7F8FB44715F004525F825E2294EB78D944CA50

Function 0085D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0085D76F
__alloca_probe_16.LIBCMT ref: 0085D838
__freea.LIBCMT ref: 0085D89F

Part of subcall function 0085BF11: RtlAllocateHeap.NTDLL(00000000,0085DF35,?,?,0085DF35,00000220,?,00000000,?), ref: 0085BF43

__freea.LIBCMT ref: 0085D8B2
__freea.LIBCMT ref: 0085D8BF

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 9bdda93d43c219a9bca942ca8d2e0b984dfb3a6a7b1a238a1e5567bdc80f35eb
Instruction ID: 60fdd974f5626eca6d07cc6dca985bdd0e7f262065b3bb555b4f858f3e9a90a0
Opcode Fuzzy Hash: 9bdda93d43c219a9bca942ca8d2e0b984dfb3a6a7b1a238a1e5567bdc80f35eb
Instruction Fuzzy Hash: 0151927260030AAFFB319F64CC81EBB7AA9FF44752B150939FD04DA251EB70DC5896A1

Function 0084EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0084F005
AcquireSRWLockExclusive.KERNEL32(00848E38), ref: 0084F024
AcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F052
TryAcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F0AD
TryAcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F0C4

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8e9c77e5f0ebecc6147192c2b0d2992ba5c5ba1df93278ebfdfbf0f0066d730a
Instruction ID: e9b8049a466507a30e907bdbf78ac5b654dc916a9e8260926d2c88c0cb71bcbc
Opcode Fuzzy Hash: 8e9c77e5f0ebecc6147192c2b0d2992ba5c5ba1df93278ebfdfbf0f0066d730a
Instruction Fuzzy Hash: 93412271900A0EDFCB25CF65C4849AAB3B5FF88315B20492EE65AC7943E730E985CB52

Function 00843C70 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00843CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00843CE0
__Getctype.LIBCPMT ref: 00843D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00843DD8

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: f334cd36094b196f7175ff1a93741d6232110c861549e6c5f5620d0820ed9903
Instruction ID: c943cce74b4f54a329b2b98dbbc9f708b1ade9b64d59f99c4568610334a73f93
Opcode Fuzzy Hash: f334cd36094b196f7175ff1a93741d6232110c861549e6c5f5620d0820ed9903
Instruction Fuzzy Hash: 57414A71E002188FCB14DF98D845BAEBBB1FF58720F148119D829AB395DB35AE45CF91

Function 0084D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0084D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0084D4D3
int.LIBCPMT ref: 0084D4EA

Part of subcall function 0084C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0084C1F6
Part of subcall function 0084C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0084C210

codecvt.LIBCPMT ref: 0084D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0084D544

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 64eed041b6678f7be20db7a6b629c49c0c0b89a0446227025d2ff5eba4b65917
Instruction ID: 6dcd7cbeeded4cbe060430c9a2e573b06801fc2d3a67eebf487b1fb5639a0f6e
Opcode Fuzzy Hash: 64eed041b6678f7be20db7a6b629c49c0c0b89a0446227025d2ff5eba4b65917
Instruction Fuzzy Hash: 1901613190022D9BCB05EBA88915AAEBBB5FF84724F154419E915EB292DF749E40CB83

Function 0084ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0084ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0084ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0084AE57

Part of subcall function 0084ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0084ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0084AE04
_Yarn.LIBCPMT ref: 0084AE1A

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: af1da5c2393802aa48dee107a508669859d2fe62bc633dfcb5991d8e2e3ff2f8
Instruction ID: 4d77a58cc0cc8b593d488be1ecf17fcdbd701f6121778b848d04bed5ae6f7cdf
Opcode Fuzzy Hash: af1da5c2393802aa48dee107a508669859d2fe62bc633dfcb5991d8e2e3ff2f8
Instruction Fuzzy Hash: 8401D475A402249BCB0AEF28D85557D7B71FF84750B04401DE915DB382CF38AE82CB83

Function 0084B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0084B809

Strings

RCC, xrefs: 0084B795
csm, xrefs: 0084B7A1
MOC, xrefs: 0084B789

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f5c39e9f1fea5ba7eb4b1792c54c1a2ff34d25d5ef1f5812f1edf9f387d2e370
Instruction ID: 1db18e1a61b6c98d5ecb49640332d98d9b72544e5678fcb5c90000ea0dc95de3
Opcode Fuzzy Hash: f5c39e9f1fea5ba7eb4b1792c54c1a2ff34d25d5ef1f5812f1edf9f387d2e370
Instruction Fuzzy Hash: DC21B03590060DDFCF289FA8C895B6AB7ACFF44761F14492EE451C7690DB34EA40CA82

Function 00866940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,008669DC,00000000,?,0087D2B0,?,?,?,00866913,00000004,InitializeCriticalSectionEx,00870D34,00870D3C), ref: 0086694D
GetLastError.KERNEL32(?,008669DC,00000000,?,0087D2B0,?,?,?,00866913,00000004,InitializeCriticalSectionEx,00870D34,00870D3C,00000000,?,0085BBBC), ref: 00866957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0086697F

Strings

api-ms-, xrefs: 00866964

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 02afe2d533ee4fa7faddf8aec972468e6d5592aeaa4f093cf3a91bd072520106
Instruction ID: da3ca9d5d2a55830cf8bbffd50ee032d48ccbc967be2c21ef5db7eb71d22aa1e
Opcode Fuzzy Hash: 02afe2d533ee4fa7faddf8aec972468e6d5592aeaa4f093cf3a91bd072520106
Instruction Fuzzy Hash: 5FE0E570390A44BAEA211A64EC0AB693F55FF50B91F154824FD4DEC4A4FB72E8B09944

Function 00863F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1D994CD9,00000000,00000000,?), ref: 00864001

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00864253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00864299
GetLastError.KERNEL32 ref: 0086433C

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 47289ad6588489dff89dbd4f0d101212faad68e1cd480eff0d0ce474df5acab1
Instruction ID: 9cd939f8b3447cc6f587688e5f68a7234fcd0d86aed0c0b5e4067fd5d5cbd08c
Opcode Fuzzy Hash: 47289ad6588489dff89dbd4f0d101212faad68e1cd480eff0d0ce474df5acab1
Instruction Fuzzy Hash: 23D178B5E002589FCF15CFE8C884AEDBBB5FF19314F29412AE926EB351D630A941CB50

Function 0085B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0085B35C
___AdjustPointer.LIBCMT ref: 0085B37F
___AdjustPointer.LIBCMT ref: 0085B41B

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 71a6074bc9a23fb22c2f9914bb8d89a4f9c9d33a1e78f09687c170740c592e66
Instruction ID: e2709393e3e890c916036cff81be2bc286203ab8343d6ffb8c001e31808b96f4
Opcode Fuzzy Hash: 71a6074bc9a23fb22c2f9914bb8d89a4f9c9d33a1e78f09687c170740c592e66
Instruction Fuzzy Hash: BF51B171A046069FDB259F54C882BAABBE4FF24716F14402DED06E7391E731ED88CB91

Function 00847220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008472C5
std::_Throw_Cpp_error.LIBCPMT ref: 00847395
std::_Throw_Cpp_error.LIBCPMT ref: 008473A3
std::_Throw_Cpp_error.LIBCPMT ref: 008473B1

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 1da31b49a23766ba4e8d480f4596810a08be05ee4b4c766d2954ff21f62adefe
Instruction ID: 8f1639ea4c584642e8fe0a2905d0b0beeca53f7705142dcff3c9a3b1bb4aef27
Opcode Fuzzy Hash: 1da31b49a23766ba4e8d480f4596810a08be05ee4b4c766d2954ff21f62adefe
Instruction Fuzzy Hash: 8241E4B190470D8BDB20DF68C841B6AB7A8FF44324F544639D856D7791EB30E814CB92

Function 00844460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00844495
std::_Lockit::_Lockit.LIBCPMT ref: 008444B2
std::_Lockit::~_Lockit.LIBCPMT ref: 008444D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00844580

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: c9508b7cf880892a79621727dd5cc5a42aaa00266be8a38a0ab61533451a73cc
Instruction ID: 982b0ab9616c8027743c683d285d5f1a5903562926891053a1a2d238a0bf9c4c
Opcode Fuzzy Hash: c9508b7cf880892a79621727dd5cc5a42aaa00266be8a38a0ab61533451a73cc
Instruction Fuzzy Hash: AE414CB1D002198FCF14DF98D885BADBBB0FB48724F154269E919AB391DB34AD84CF91

Function 00861DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

GetLastError.KERNEL32 ref: 00861E2A
__dosmaperr.LIBCMT ref: 00861E31
GetLastError.KERNEL32 ref: 00861E6B
__dosmaperr.LIBCMT ref: 00861E72

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f67a56be0eeb3fa21372eba8a64432fb1690f05b7928541eaddb76a0ffb8dcbf
Instruction ID: 5c22f4848325da1e66ac7e1984b4e62f2a79f1988ae1b452ee10c21378ddf6bb
Opcode Fuzzy Hash: f67a56be0eeb3fa21372eba8a64432fb1690f05b7928541eaddb76a0ffb8dcbf
Instruction Fuzzy Hash: A9210471604615AFDF20AF69D88882BB7A9FF04365B1A8518FC19D7102EB32EC008BA1

Function 00852BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee40936f01c707b7751ff8b1e9e49e124d6700735294f7fbaa0c1c68039d22f
Instruction ID: 4321b4934a9d5db10b65c023e3cdf068b8f56929bd56d8cb95d5db10b7833848
Opcode Fuzzy Hash: bee40936f01c707b7751ff8b1e9e49e124d6700735294f7fbaa0c1c68039d22f
Instruction Fuzzy Hash: 0721CD31204619AF9B21AF6D9C8092A77A9FF52366B108514FC59D7252EF30EC488BA2

Function 008631BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008631C6

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008631FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0086321E

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: dda36894cbf54aef00de1e48621ab2b803f572402ddd028c1904c4086d57080c
Instruction ID: ec70f1144b93b44245240a66ec8d23683ae4b395a0bbe732083154ed3c39a25c
Opcode Fuzzy Hash: dda36894cbf54aef00de1e48621ab2b803f572402ddd028c1904c4086d57080c
Instruction Fuzzy Hash: FF1122B1500A197FAB2227B99C8ECBF7A5CFED43AA7110028FA05D1201FF64DF0485B2

Function 0084E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0084E899
std::_Lockit::_Lockit.LIBCPMT ref: 0084E8A3
int.LIBCPMT ref: 0084E8BA

Part of subcall function 0084C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0084C1F6
Part of subcall function 0084C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0084C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0084E914

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 95f42a6087b373cd9c9e3328040d91e7d7294150c6939a840501c63e4a72358d
Instruction ID: 54bdfc9cf8def6ad6dc55d413e756f60f5cc9c4c0f9a38cb1479ad5cc1a3dacc
Opcode Fuzzy Hash: 95f42a6087b373cd9c9e3328040d91e7d7294150c6939a840501c63e4a72358d
Instruction Fuzzy Hash: 1C11AD3190422D9BCB09EBA8C945ABEBF75FF84724F254119E515EB2D2CF749E40CB82

Function 0086ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000), ref: 0086ADB7
GetLastError.KERNEL32(?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?,?,?,00863CD6,00000000), ref: 0086ADC3

Part of subcall function 0086AE20: CloseHandle.KERNEL32(FFFFFFFE,0086ADD3,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?,?), ref: 0086AE30

___initconout.LIBCMT ref: 0086ADD3

Part of subcall function 0086ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0086AD91,0086A2DC,?,?,00864390,?,00000000,00000000,?), ref: 0086AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?), ref: 0086ADE8

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5904e405a97f6b55f219dbcb2de3916bff54ba2f0aa4ea7d041604095035df1a
Instruction ID: e39498b4bae4ce3d38cf19c9b4ca4ba1d9cca6a3f0f1fe3e1fdf3752ddc11ab6
Opcode Fuzzy Hash: 5904e405a97f6b55f219dbcb2de3916bff54ba2f0aa4ea7d041604095035df1a
Instruction Fuzzy Hash: F4F01C36514118BFCF221FD5DC0899A3F26FF497A2B014011FA0CA6524EB32CCA0AF92

Function 008504F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00850507
GetCurrentThreadId.KERNEL32 ref: 00850516
GetCurrentProcessId.KERNEL32 ref: 0085051F
QueryPerformanceCounter.KERNEL32(?), ref: 0085052C

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 93918f4d74c2ae9edbc3b846c7a38b6f4193ab3ef136e987e7c96cf2cd53140e
Instruction ID: c5ca3c036595d07c335f78903483485fbeaffcf756d2f3ca1e81f7a1c1b9bb61
Opcode Fuzzy Hash: 93918f4d74c2ae9edbc3b846c7a38b6f4193ab3ef136e987e7c96cf2cd53140e
Instruction Fuzzy Hash: AEF0B270D1020CEBCB00DFB4DA4898EBBF4FF1C204B914995E416E7114EB30EB948B50

Function 00860976 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(?,?,00855495,00878E38,0000000C), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000), ref: 0085C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00855BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00860A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00855BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00860A6C

Strings

utf8, xrefs: 00860B3E

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 3dc68e5475c482730a8a161b01a022fda351216d20ce9b778f927b22e8486ef3
Instruction ID: 120520e900ace504cd23db7745a21e572d7043c2a1820fdefb01f59711d54791
Opcode Fuzzy Hash: 3dc68e5475c482730a8a161b01a022fda351216d20ce9b778f927b22e8486ef3
Instruction Fuzzy Hash: D7512831A00705AADB25AB748C42FBB73A8FF05755F168429F549D7182FAB0DD408F6A

Function 008473E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00847526
___std_exception_copy.LIBVCRUNTIME ref: 00847561

Part of subcall function 0084AF37: CreateThreadpoolWork.KERNEL32(0084B060,00848A2A,00000000), ref: 0084AF46
Part of subcall function 0084AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0084AF53

Strings

Fail to schedule the chore!, xrefs: 00847551, 00847560

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 24482dc271c5f40686070e13ba6d9b60dd566a811ae420cbeb8ee9a2b6cc1789
Instruction ID: 15a08646072fed8d983a9402460bf577e83f863a8110990fa2b03798ad0b5e57
Opcode Fuzzy Hash: 24482dc271c5f40686070e13ba6d9b60dd566a811ae420cbeb8ee9a2b6cc1789
Instruction Fuzzy Hash: 51518EB1D01218DFCB05DF94D844BAEBBB5FF08314F144129E919AB391E775A909CF92

Function 0085B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0085B893,?,?,00000000,00000000,00000000,?), ref: 0085B9B7

Strings

MOC, xrefs: 0085B9C9
RCC, xrefs: 0085B9D1

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 46cbe7b083b6c10cd03454bfa792b372b7bb321499ac125c81f3fec9f9fcd135
Instruction ID: 1bb224d1f7bdcc7be1e6c0418859cb4e7f02a181e0d2ea184ce082d08810d7e2
Opcode Fuzzy Hash: 46cbe7b083b6c10cd03454bfa792b372b7bb321499ac125c81f3fec9f9fcd135
Instruction Fuzzy Hash: 22417832900219AFCF16DF98CC81AEEBBB5FF58302F188199FE14A7211E3359954DB91

Function 00843E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00844002

Part of subcall function 0084ABC5: _Yarn.LIBCPMT ref: 0084ABE5
Part of subcall function 0084ABC5: _Yarn.LIBCPMT ref: 0084AC09

Strings

bad locale name, xrefs: 00843F46

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: 4f49c2d0079201cb2d121cf9165136044d33c8df1904fd563454d7f9b954d9b6
Instruction ID: 3971b17d0fdeeb8854d8bc23969670d760f301c24e8c22cb303058dfdea48b74
Opcode Fuzzy Hash: 4f49c2d0079201cb2d121cf9165136044d33c8df1904fd563454d7f9b954d9b6
Instruction Fuzzy Hash: C0412BF1A007459BEB10DF69C805B57BAE8BF04714F044628E459DB781E7B9E518CBE2

Function 0085B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0085B475

Strings

csm, xrefs: 0085B497
csm, xrefs: 0085B508

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 841eeca0df29e4de03570fdc4d44e52307da6379f40954317595591876774017
Instruction ID: 8ed4ed461676dc31d2948c028783ef7056efb5a9abc3f77a02eced55c16f65aa
Opcode Fuzzy Hash: 841eeca0df29e4de03570fdc4d44e52307da6379f40954317595591876774017
Instruction Fuzzy Hash: 3B31FB75400219EBCF3A9F54CC448AE7B66FF28317B18465AFD44CA122D332DDA9DB82

Function 0084B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0084B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0084B8DE

Part of subcall function 0085060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0084F354,02BB37B8,?,?,?,0084F354,00843D4A,0087759C,00843D4A), ref: 0085066D

Part of subcall function 00858353: IsProcessorFeaturePresent.KERNEL32(00000017,0085C224), ref: 0085836F

Strings

csm, xrefs: 0084B86D

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 1bce12d7cfd8d9cc2ebcc6527fec4351db28f9ccea6b2e496a16ce6fdd2af7eb
Instruction ID: d4d0f6f604d992ed8e2ba966acf26d643022d82275504995e93b62fbf397e6b7
Opcode Fuzzy Hash: 1bce12d7cfd8d9cc2ebcc6527fec4351db28f9ccea6b2e496a16ce6fdd2af7eb
Instruction Fuzzy Hash: F2215331E0021CEBCF24DF99D845AAEB7B9FF50750F180429E906EB251DB70ED458B82

Function 0084B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00842673

Strings

ios_base::badbit set, xrefs: 00842650
bad array new length, xrefs: 00842626

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: ccf713c7908f342ed5ec2234810fb6c2d6ba4cb7c87254e40090bc4cb9e5dfdc
Instruction ID: 3a43a748f3257e0e3005032640890d31111127463681b1a3bd406ef20a3bd189
Opcode Fuzzy Hash: ccf713c7908f342ed5ec2234810fb6c2d6ba4cb7c87254e40090bc4cb9e5dfdc
Instruction Fuzzy Hash: B2019EF1604304ABDB049F28D855A1A7BE4FB18318F11881CF559CB301D375E808CB82

Function 00842610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0084F354,02BB37B8,?,?,?,0084F354,00843D4A,0087759C,00843D4A), ref: 0085066D

___std_exception_copy.LIBVCRUNTIME ref: 00842673

Strings

ios_base::badbit set, xrefs: 00842650
bad array new length, xrefs: 00842626

Memory Dump Source

Source File: 00000000.00000002.1694812963.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000000.00000002.1694797495.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694841420.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694859445.000000000087A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695774169.000000000087B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695796698.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695815500.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695853931.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 5184c4caf2ad40d7666167fc9f98797256676602d4bca5216ecbaf66da611765
Instruction ID: 4f54ca43b7d51de82d174464fec8d91e38ac6bf0e3ae3c626541bca1613f010f
Opcode Fuzzy Hash: 5184c4caf2ad40d7666167fc9f98797256676602d4bca5216ecbaf66da611765
Instruction Fuzzy Hash: 14F0D4F1A14300ABD700AF58D849747BAE4FB59719F12881CFA98DB300D3B5D458CB92

Analysis Process: Crosshair-X.exePID: 4464, Parent PID: 5288COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.4%
Total number of Nodes:	53
Total number of Limit Nodes:	6

Executed Functions

Function 00408680 Relevance: 7.8, APIs: 5, Instructions: 326
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004086A4
GetCurrentThreadId.KERNEL32 ref: 004086AE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408801
GetForegroundWindow.USER32 ref: 00408930

Part of subcall function 0040C840: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C853

Part of subcall function 0040B500: FreeLibrary.KERNEL32(00408A73), ref: 0040B506
Part of subcall function 0040B500: FreeLibrary.KERNEL32 ref: 0040B527

ExitProcess.KERNEL32 ref: 00408A8C

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: dacdd09466a324c1bf5524c4d89d99e6785de18e134b5e647da144b5f1cecb64
Instruction ID: eabe80a0988320ad0fe8d5dff74cf57d9a85e1bf4da21146afe843ea261adb29
Opcode Fuzzy Hash: dacdd09466a324c1bf5524c4d89d99e6785de18e134b5e647da144b5f1cecb64
Instruction Fuzzy Hash: 9FA12673E487144BD318AF69CC5235BF6D6ABC4714F0BC53EA889E7395EEB88C018685

Function 0040AECE Relevance: 6.7, Strings: 5, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"j!h, xrefs: 0040AFF2
n&G$, xrefs: 0040AF89
:n=l, xrefs: 0040AFEB
8r<p, xrefs: 0040AFE4
f?d, xrefs: 0040AFF9

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: f?d$"j!h$8r<p$:n=l$n&G$
API String ID: 0-4152412813
Opcode ID: 2ac745100180af5c69f0f813abfbf65c9568c07f9aaa2a30594b6bdae996c659
Instruction ID: f39bb9ca2a08d60f92e0ff944048c6f981221b2073873a5d09da46bf52393ac3
Opcode Fuzzy Hash: 2ac745100180af5c69f0f813abfbf65c9568c07f9aaa2a30594b6bdae996c659
Instruction Fuzzy Hash: D6F1CBB5200B02CFD324CF25D881B56BBB2FB4A310F19867DD55A8B6A2D334E855CF99

Function 0043DD60 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(004414A0,?,00000018,?,?,00000018,?,?,?), ref: 0043DD8E

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043DFFB Relevance: 1.4, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|&E, xrefs: 0043E0B9

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: |&E
API String ID: 0-1740799517
Opcode ID: 0931667cd185c21d7644e9aa89c837d0d9cddbc7fbd69f65816085b93e51aab9
Instruction ID: fe65b27999aadb237a282f0d043f4477ea190b92c2fb107026df1515e9e5e4d7
Opcode Fuzzy Hash: 0931667cd185c21d7644e9aa89c837d0d9cddbc7fbd69f65816085b93e51aab9
Instruction Fuzzy Hash: E8514976E112258BDB28CF25C85167BF7B2FF99300F19946DC886AB391D7789C02C794

Function 0043E665 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043E665
GetForegroundWindow.USER32 ref: 0043E680

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: b2412eb72c14a2f95b85ec42464bed5094b0225504fe54e0e84df741a6296e60
Instruction ID: cb20e1a5d60d206dd47ed1627e8893cbee1526d5e7480df64a797c5a63076adf
Opcode Fuzzy Hash: b2412eb72c14a2f95b85ec42464bed5094b0225504fe54e0e84df741a6296e60
Instruction Fuzzy Hash: 49D0C7B9D510404B9705AF61BC5646B3316AF4B60FB48503DF50301633E7255619C64E

Function 00436103 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436132

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c7250859cb3b9fe14a3d82ee89100373c5bea2be81fee64b46e027dd57f3e5a7
Instruction ID: a6f1a487d13d39ce5863ba8db285ee1c04577832e08c540f1a341033151f45ad
Opcode Fuzzy Hash: c7250859cb3b9fe14a3d82ee89100373c5bea2be81fee64b46e027dd57f3e5a7
Instruction Fuzzy Hash: FF11C2249047878FCF24CB388C553AE7FB15F2A320F15439DD99A973E2D6254A81CB52

Function 0043DD02 Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043DD2A

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0b67cc455f2c991f7c3737809b6b24a3feaa5914fb18de76812f77347bde2f7c
Instruction ID: 61a143b709c9f2bbe2a982b82dfe490be4ee5373b6e45d20039246120c229fdc
Opcode Fuzzy Hash: 0b67cc455f2c991f7c3737809b6b24a3feaa5914fb18de76812f77347bde2f7c
Instruction Fuzzy Hash: FAE07D36974101E7D2042F387D06B5B3534DFE7789F011437F001A5066DF2DC812929E

Function 0040C840 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C853

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 369f76dbda4c5c1fb59ce705134cd82ae0c6b45717b1564207481ecceba7868e
Instruction ID: 02eb813cb4ea6b382a5a54953304757577123e7e3f30dc08e0c702606f6c9218
Opcode Fuzzy Hash: 369f76dbda4c5c1fb59ce705134cd82ae0c6b45717b1564207481ecceba7868e
Instruction Fuzzy Hash: 34D02BB67446045BF30CAF28ED07F16362A63C3B65F408338A563861D6D9202802C16C

Function 0040C87D Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C88F

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 02cc0357af2a1282849c1fc99fe9a8f31966633488f5ee9ec0c58b9523934b0c
Instruction ID: 93d07af8e15d5c5891f9d9328754b4add415c4753f78ba6a3f89e21f3bb60a06
Opcode Fuzzy Hash: 02cc0357af2a1282849c1fc99fe9a8f31966633488f5ee9ec0c58b9523934b0c
Instruction Fuzzy Hash: 53D092383D87007BEA645B18AC57F1462506706F25F300224B366FE7E1C99061008A0C

Function 0043C060 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,00000004,0043C300,?), ref: 0043C080

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d6d32710ebd2c982b0e01aca522612ae8a6808f660f3acf0a917316f46dea714
Instruction ID: b8ffc7b635715acb642a12f03b921adf348de50e9db53c95b6d81706696e969f
Opcode Fuzzy Hash: d6d32710ebd2c982b0e01aca522612ae8a6808f660f3acf0a917316f46dea714
Instruction Fuzzy Hash: 11D0C932815132FBCA112B28BC16BC73A949F5A225F0748A2B4006B0B6D674DC91DAD8

Function 0043C04B Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 0043C051

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6aff9c068d56e6ff4ebf23b71d8028e304f2e2c49e045871fdbc904bdb25a5c1
Instruction ID: 2915834580b57b887275cc2cf2b3162d5046227f6f14af2f6d1c1ee5262823b3
Opcode Fuzzy Hash: 6aff9c068d56e6ff4ebf23b71d8028e304f2e2c49e045871fdbc904bdb25a5c1
Instruction Fuzzy Hash: 75A01130080220ABCA282B00BE08FC23E20EB22222F0200A2B000080B282A08882CA88

Function 0040CDB1 Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0040CDB1

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: Uninitialize
String ID:
API String ID: 3861434553-0
Opcode ID: 8fcaa2b2ce65f703ba86f13ff2d7eaa034a07b28c59d1641a2dde7befe53fb4b
Instruction ID: 9b08bc60223325e1bf5aba78b706ddf8b1f3cefbdabe50960730c25430284ab0
Opcode Fuzzy Hash: 8fcaa2b2ce65f703ba86f13ff2d7eaa034a07b28c59d1641a2dde7befe53fb4b
Instruction Fuzzy Hash: B9C04C3825C641DBD649CB31DC9556933BAEB9A706B14D479C043877A6DA305416864C

Non-executed Functions

Function 00432A40 Relevance: 71.9, APIs: 1, Strings: 40, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432AFE

Strings

4, xrefs: 00432BFF
?, xrefs: 00432C97
\, xrefs: 00432CBF
", xrefs: 00432C4F
w, xrefs: 00432B29
8, xrefs: 00432B9F
., xrefs: 00432C2F
H, xrefs: 00432B3D
J, xrefs: 00432BA7
0, xrefs: 00432BDF
8, xrefs: 00432CB7
`, xrefs: 00432B15
M, xrefs: 00432B97
>, xrefs: 00432BAF
^, xrefs: 00432CAF
<, xrefs: 00432BBF
P, xrefs: 00432B1F
(, xrefs: 00432C1F
6, xrefs: 00432BEF
, xrefs: 00432C5F
R, xrefs: 00432CCF
B, xrefs: 00432BB7
#, xrefs: 00432B57
$, xrefs: 00432C7F
&, xrefs: 00432C6F
P, xrefs: 00432CDF
Z, xrefs: 00432C8F
_, xrefs: 00432B67
A, xrefs: 00432C17
y, xrefs: 00432B47
:, xrefs: 00432B8F
Q, xrefs: 00432C67
*, xrefs: 00432C0F
X, xrefs: 00432C9F
L, xrefs: 00432B33
,, xrefs: 00432C3F
', xrefs: 00432B77
S, xrefs: 00432CD7
r, xrefs: 00432BD7
2, xrefs: 00432BCF

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: AllocString
String ID: $"$#$$$&$'$($*$,$.$0$2$4$6$8$8$:$<$>$?$A$B$H$J$L$M$P$P$Q$R$S$X$Z$\$^$_$`$r$w$y
API String ID: 2525500382-810699627
Opcode ID: 0dca25496aefb40c577bd73c3ef91dbf49218b3d3d3069416841fbfb493506a1
Instruction ID: f20fc5b02ddb50d1b854d250108d6647cbe28fecb208b1a4e36db86450dcc2b7
Opcode Fuzzy Hash: 0dca25496aefb40c577bd73c3ef91dbf49218b3d3d3069416841fbfb493506a1
Instruction Fuzzy Hash: 41A16D2160C7D18ED336863C885939FBEC11BE7228F094A9DD5ED4B2D3CAB94509C767

Function 004315E0 Relevance: 71.9, APIs: 1, Strings: 40, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043168A

Strings

0, xrefs: 0043176D
P, xrefs: 0043186D
6, xrefs: 0043177D
P, xrefs: 004316AD
$, xrefs: 0043180D
#, xrefs: 004316E5
J, xrefs: 00431735
(, xrefs: 004317AD
., xrefs: 004317BD
L, xrefs: 004316C1
&, xrefs: 004317FD
8, xrefs: 00431845
`, xrefs: 004316A3
_, xrefs: 004316F5
8, xrefs: 0043172D
<, xrefs: 0043174D
?, xrefs: 00431825
R, xrefs: 0043185D
X, xrefs: 0043182D
y, xrefs: 004316D5
\, xrefs: 0043184D
^, xrefs: 0043183D
Q, xrefs: 004317F5
:, xrefs: 0043171D
M, xrefs: 00431725
", xrefs: 004317DD
B, xrefs: 00431745
H, xrefs: 004316CB
Z, xrefs: 0043181D
S, xrefs: 00431865
', xrefs: 00431705
, xrefs: 004317ED
A, xrefs: 004317A5
w, xrefs: 004316B7
r, xrefs: 00431765
,, xrefs: 004317CD
4, xrefs: 0043178D
>, xrefs: 0043173D
2, xrefs: 0043175D
*, xrefs: 0043179D

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: AllocString
String ID: $"$#$$$&$'$($*$,$.$0$2$4$6$8$8$:$<$>$?$A$B$H$J$L$M$P$P$Q$R$S$X$Z$\$^$_$`$r$w$y
API String ID: 2525500382-810699627
Opcode ID: 65bdd9a008074facf1bd4fdb788f66b981c574430443fbea6f4c089478d32145
Instruction ID: ef76fa19242391fc9bd363bc58e8f012340550a420c0dee2cf56ccd12a9d6e40
Opcode Fuzzy Hash: 65bdd9a008074facf1bd4fdb788f66b981c574430443fbea6f4c089478d32145
Instruction Fuzzy Hash: ADA16C2160C7C18EE336863C885939FBEC11BE7228F094A9DD5ED4B3D3CAB945098767

Function 004334D0 Relevance: 50.9, APIs: 2, Strings: 27, Instructions: 174COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00433519
GetSystemMetrics.USER32 ref: 00433529

Strings

, xrefs: 00433616
t<C, xrefs: 00433740
&<C, xrefs: 0043374B
t<C, xrefs: 00433782
*CC, xrefs: 00433761
t<C, xrefs: 0043378D
t<C, xrefs: 004337CF
t<C, xrefs: 004336E8
t<C, xrefs: 004337FB
t<C, xrefs: 004336BC
t<C, xrefs: 004337F0
t<C, xrefs: 004336C7
=C, xrefs: 004336FE
t<C, xrefs: 0043371F
t<C, xrefs: 004336D2
:C, xrefs: 004336A6
t<C, xrefs: 004337AE
t<C, xrefs: 00433714
~DC, xrefs: 004337E5
t<C, xrefs: 004337DA
t<C, xrefs: 00433735
:C, xrefs: 0043376C
>C, xrefs: 0043372A
t<C, xrefs: 00433777
CC, xrefs: 0043369B
t<C, xrefs: 004336F3
t<C, xrefs: 004337A3

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: MetricsSystem
String ID: $&<C$*CC$:C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$t<C$~DC$:C$=C$>C$CC
API String ID: 4116985748-1632335654
Opcode ID: 6dff38ffafbb10221c56d6f5494940dc9c295d6bf78e0d9b7260acc0cc0bc3dc
Instruction ID: 3d5d168710d57ee167ab9eca3015516b113f4f838193d13a39da8d7fdac03116
Opcode Fuzzy Hash: 6dff38ffafbb10221c56d6f5494940dc9c295d6bf78e0d9b7260acc0cc0bc3dc
Instruction Fuzzy Hash: 38B15BB041A3888FE774DF15C58979EBBE0FB85708F00891EE5988B350C7B85549CF9A

Function 00438DC0 Relevance: 28.6, APIs: 10, Strings: 6, Instructions: 614memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C,00000000), ref: 0043900A
SysAllocString.OLEAUT32(58245A70), ref: 00439067
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004390AD
SysAllocString.OLEAUT32(61B167B9), ref: 00439110
SysAllocString.OLEAUT32(61B167B9), ref: 004391BA
VariantInit.OLEAUT32(D9D8DFD6), ref: 00439225
VariantClear.OLEAUT32(?), ref: 004393A8
SysFreeString.OLEAUT32(?), ref: 004393D0
SysFreeString.OLEAUT32(?), ref: 004393D6

Strings

Xrsp, xrefs: 00438F02
:, xrefs: 00438FB9
d7g1, xrefs: 00439055
YV, xrefs: 0043925F
\, xrefs: 00438FC4
e3`=, xrefs: 00439020

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: String$Alloc$FreeVariant$BlanketClearCreateInitInstanceProxy
String ID: :$Xrsp$YV$\$d7g1$e3`=
API String ID: 3490847348-1510934275
Opcode ID: 7eb7ce4718dce13f76be410733157b9cf7767b50c8ed0b77f8a01274eec6001c
Instruction ID: 848e2ce4f2c3d07268f08617978c1b7cabf7425fa1e2c732810c4fb09bee5186
Opcode Fuzzy Hash: 7eb7ce4718dce13f76be410733157b9cf7767b50c8ed0b77f8a01274eec6001c
Instruction Fuzzy Hash: C512E076A083409FD710CF69C88075BBBE2EBC9714F14892DF9959B391C7B8D905CB86

Function 00423730 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 409COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 004237E8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0042385A

Strings

?Q<S, xrefs: 00423BA3
K)K+, xrefs: 00423B93
]_, xrefs: 004239E7
S=S?, xrefs: 00423B7B
^1V3, xrefs: 00423B63
J%O', xrefs: 00423B8B
MO, xrefs: 004238B5
@A, xrefs: 00423BC3

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ?Q<S$@A$J%O'$K)K+$S=S?$^1V3$MO$]_
API String ID: 237503144-211844116
Opcode ID: c87d522e612ed962fa4ecd8c277ad0997bc9d569ccee6c419b766c3c979297e1
Instruction ID: b761aa693eda798c55f79d3232c0833f2606dbd92c11650264d9da13dcfa462f
Opcode Fuzzy Hash: c87d522e612ed962fa4ecd8c277ad0997bc9d569ccee6c419b766c3c979297e1
Instruction Fuzzy Hash: 12C1FFB46083518FD310DF65E89126BBBF1EFC6315F448A2DE5D68B340DB788946CB86

Function 0041E240 Relevance: 13.3, Strings: 10, Instructions: 829COMMON

Download Yara Rule

Strings

CJGW, xrefs: 0041E550
XDAA, xrefs: 0041E568
&, xrefs: 0041E473
gncs, xrefs: 0041E598
6-v<, xrefs: 0041E5A8
%H, xrefs: 0041E558
FGOH, xrefs: 0041E560
SGWS, xrefs: 0041E578
$, xrefs: 0041E906
dca$, xrefs: 0041E40A

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: $$&$6-v<$CJGW$FGOH$SGWS$XDAA$dca$$gncs$%H
API String ID: 0-2567165219
Opcode ID: ebc0182c2b312a18733827621b348a28c7f14e54506b3cc48865db96795604bb
Instruction ID: ebe2843a33e16690389dfa48c484cc8a1ca90b1526a99ddc332eadeccd98d69c
Opcode Fuzzy Hash: ebc0182c2b312a18733827621b348a28c7f14e54506b3cc48865db96795604bb
Instruction Fuzzy Hash: 8C524A7450C3908FC725DF25C8407AFBBE1AF86304F08866EE8E55B392D7399949CB96

Function 00428310 Relevance: 12.9, APIs: 2, Strings: 5, Instructions: 692COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004283D1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042842F

Strings

"#`, xrefs: 004283E5
&@AF, xrefs: 0042833A
@A, xrefs: 004285A7
HI, xrefs: 0042876A
"#`, xrefs: 004283A0

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: "#`$"#`$&@AF$@A$HI
API String ID: 237503144-3888265313
Opcode ID: 9cdf12974c0a9833ca7c344cd6375dbeaa15c7f9f6be0858825427d2b41fcbc3
Instruction ID: 38a4f7a1e83fc4c522501c2c4e651e4739e84585521ceade4aac20272e12b8f8
Opcode Fuzzy Hash: 9cdf12974c0a9833ca7c344cd6375dbeaa15c7f9f6be0858825427d2b41fcbc3
Instruction Fuzzy Hash: 363200B16083518FD714DF68D85176FB7E1EF85304F04892EE9D58B382EB389906CB9A

Function 00433330 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433352
GetClipboardData.USER32 ref: 00433373
CloseClipboard.USER32 ref: 004334B9

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 9717dd624323f6a0f409f6f8d250936eafbde0b3fe7887fb6ab28b9efa3a08ab
Instruction ID: eeaf64ca92df5765018a50bfd7b5975e2f88e63ffb0f80d8313722f2f437dc96
Opcode Fuzzy Hash: 9717dd624323f6a0f409f6f8d250936eafbde0b3fe7887fb6ab28b9efa3a08ab
Instruction Fuzzy Hash: 3741F3B08087829FD701AF78D44939EBFA0AF16315F04853ED8D987242D37D9A58C7A7

Function 00861A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,00000000,?,?,?,008613BD,?,00000000), ref: 00861AA0
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,00000000,?,?,?,008613BD,?,00000000), ref: 00861AC9
GetACP.KERNEL32(?,?,008613BD,?,00000000), ref: 00861ADE

Strings

ACP, xrefs: 00861A25
OCP, xrefs: 00861A5B

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0d477d2624081a92ac096f61804047db67a930863875a500049795a168443f84
Instruction ID: f65857f251883a924d1387aced5cd338a663dd1892d36a066156d165a46315ab
Opcode Fuzzy Hash: 0d477d2624081a92ac096f61804047db67a930863875a500049795a168443f84
Instruction Fuzzy Hash: 6521B822B0212597DF35CFE4D908A9B72A7FB50B56B5F8464E909DB206F731DD40D350

Function 00841FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00841240: _strlen.LIBCMT ref: 008412BA

GetFileSize.KERNEL32(00000000,00000000), ref: 00842046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0084206B
CloseHandle.KERNEL32(00000000), ref: 0084207A
_strlen.LIBCMT ref: 008420CD
CloseHandle.KERNEL32(00000000), ref: 008421FD

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 03b7b197ac273c93eb04ef37320a5d25f2859f8fb01aa37aae7fce060f18ff5a
Instruction ID: a4fc5ff9d234a93be40b4863e01e162a9465dcac43f0f6058a07f635875a0097
Opcode Fuzzy Hash: 03b7b197ac273c93eb04ef37320a5d25f2859f8fb01aa37aae7fce060f18ff5a
Instruction Fuzzy Hash: 7671D2B2C006189BCB10DFA8DC487AEBBB5FF58314F140629F814E7391E775A945CBA1

Function 00861287 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0085C16A: GetLastError.KERNEL32(00000000,?,0085E58D), ref: 0085C16E
Part of subcall function 0085C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00858363), ref: 0085C210

GetUserDefaultLCID.KERNEL32 ref: 0086138F
IsValidCodePage.KERNEL32(00000000), ref: 008613CD
IsValidLocale.KERNEL32(?,00000001), ref: 008613E0
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00861428
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00861443

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 44d7b84be60647e269e843a30a9e78cde77c191d6bb1fe2181d13a3d0a6a86dd
Instruction ID: 442fd1963ee6f6ac18c7cd0f20fc7e4fa2cc5c158598249f0100f768cdeafd06
Opcode Fuzzy Hash: 44d7b84be60647e269e843a30a9e78cde77c191d6bb1fe2181d13a3d0a6a86dd
Instruction Fuzzy Hash: 5A518071A00209AFDF10DFA5CD49EBE77B8FF04704F1A4465E905EB292EB74DA448B61

Function 00419A92 Relevance: 7.6, Strings: 6, Instructions: 125COMMON

Download Yara Rule

Strings

];_, xrefs: 00419AFB
3E5G, xrefs: 00419AE5
"Q!S, xrefs: 00419B06
2A=C, xrefs: 00419ADA
-U)W, xrefs: 00419B11
=Y([, xrefs: 00419AF0

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: ];_$"Q!S$-U)W$2A=C$3E5G$=Y([
API String ID: 0-1233860087
Opcode ID: 0779789e10b95b7f69b45071bbcfe072519a8d08cfbfb59a7e27c0a9082712ce
Instruction ID: 8418fbc14a2fb62faab45df73b212ad7049715b2656b99ae13f884027c8b20aa
Opcode Fuzzy Hash: 0779789e10b95b7f69b45071bbcfe072519a8d08cfbfb59a7e27c0a9082712ce
Instruction Fuzzy Hash: F131CEB66183408BC7308F18C89269BB7F0FF96764F19891DE4D89B341E3789841CB56

Function 00859CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: 9434f1657a387772096ad8682b62515607f66e190fd8a50a5503cccef071801b
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 73024C71E00619DBDF14CFA9C8806AEBBB1FF48315F24826AD919E7380D731A945CB91

Function 0084F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0084F8F5
IsDebuggerPresent.KERNEL32 ref: 0084F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0084F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0084F9E4

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 85134143be01593dc9063b9829cbd3131b99dd0c3ff03f099780f7ccd91d353a
Instruction ID: e93d1e7a9d948359ec88d9b8db3f821a8a1f08d62556f23c935ba55203227976
Opcode Fuzzy Hash: 85134143be01593dc9063b9829cbd3131b99dd0c3ff03f099780f7ccd91d353a
Instruction Fuzzy Hash: 5E31E3B5D0121DAADF21DFA5D9497CDBBB8FF08300F1041AAE50DAB251EB719A848F45

Function 00416036 Relevance: 5.8, Strings: 4, Instructions: 794COMMON

Download Yara Rule

Strings

4, xrefs: 00416451
^Z , xrefs: 004167AD
p, xrefs: 0041684E
^Z I, xrefs: 004167A6

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: 4$^Z $^Z I$p
API String ID: 2994545307-3414323742
Opcode ID: a17e6598951b1b07f8a3d7a2c4cabe0b32638e13571b7a5ea886e2d4ec53d10d
Instruction ID: 2e262dc2b98b9a6d440a53948d9e55cc81207c50161dc6622ab9f6b4936a7fa4
Opcode Fuzzy Hash: a17e6598951b1b07f8a3d7a2c4cabe0b32638e13571b7a5ea886e2d4ec53d10d
Instruction Fuzzy Hash: 153256755083409BE724CF28D850ABB7BE2EBEA300F1A847DE4C197356D734D949CB9A

Function 0041D0A0 Relevance: 4.2, Strings: 3, Instructions: 408COMMON

Download Yara Rule

Strings

KH, xrefs: 0041D37A
/,, xrefs: 0041D17E
b, xrefs: 0041D126

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: /,$KH$b
API String ID: 0-2155755540
Opcode ID: 9833fc8c0eca8366b76986b3924aad65a2340f45727e9712a310e1f8a09172d5
Instruction ID: 06014b54c36bcc2f5a6e376cde294541417629d67056aa239b76d1a095ffb95a
Opcode Fuzzy Hash: 9833fc8c0eca8366b76986b3924aad65a2340f45727e9712a310e1f8a09172d5
Instruction Fuzzy Hash: 89A102B59083118BC324DF28C8916ABB7F1EFD1354F289A1DE8D58B381E738D945C79A

Function 0040E498 Relevance: 4.0, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

OQJ>, xrefs: 0040E4E8
RQJ>, xrefs: 0040E4AA
!, xrefs: 0040E514

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: !$OQJ>$RQJ>
API String ID: 0-3745743227
Opcode ID: bf57af7d27e4d529f8e32b7c3fdc06ece7fd17807a6597af58b02b5fe45d9909
Instruction ID: 0044d20465ca1c4edbe37d9095840257e52da6dd3f56bcb882a84483ecababa5
Opcode Fuzzy Hash: bf57af7d27e4d529f8e32b7c3fdc06ece7fd17807a6597af58b02b5fe45d9909
Instruction Fuzzy Hash: 0A513C779543A14BC724CA78CC416EFB6D29FD6314F1A4A3EDCD8E7381D67849058386

Function 00414A40 Relevance: 3.6, Strings: 2, Instructions: 1149COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00415460
UNA, xrefs: 00415600, 0041568A

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: D]+\$UNA
API String ID: 0-813271945
Opcode ID: 11e83117e9188b7dc984fa0f419118913c0765587583237f76609e9272d8e72b
Instruction ID: ab7382b2cb5eacf2de73f405d84490754ae4baf3bf3219b7127510f8e247cffc
Opcode Fuzzy Hash: 11e83117e9188b7dc984fa0f419118913c0765587583237f76609e9272d8e72b
Instruction Fuzzy Hash: 2A525475608700DBE7149F24EC52BBBB3E2EBC6314F19443DE4C5972A2E7399845CB8A

Function 00428690 Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

,q>s, xrefs: 00428816
HI, xrefs: 0042876A

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: ,q>s$HI
API String ID: 0-980453730
Opcode ID: 81a8bbb51e7b765b98b78a114a96b79a4d147c3d7791d8accd824d78c1e3847e
Instruction ID: 12f67c18c4353cdc39626bfe46bfd002305e525c2329f06db05b9cd3363305f4
Opcode Fuzzy Hash: 81a8bbb51e7b765b98b78a114a96b79a4d147c3d7791d8accd824d78c1e3847e
Instruction Fuzzy Hash: 80D156B59093618FD314DF18D89126FB7E1FF96304F08892EE9D547381EB389905CB8A

Function 004292B0 Relevance: 2.9, Strings: 2, Instructions: 392COMMON

Download Yara Rule

Strings

-,#", xrefs: 00429670
^&, xrefs: 0042921D

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: -,#"$^&
API String ID: 0-105081621
Opcode ID: 1a73812664ad0a08ba8fd7af8612b341e3128dea73201b09099b3c43f5ac38b2
Instruction ID: 18d6723b1270470f5bd260c91ec4f80195ac048505bbd4fa4f2a9f825bdf5acc
Opcode Fuzzy Hash: 1a73812664ad0a08ba8fd7af8612b341e3128dea73201b09099b3c43f5ac38b2
Instruction Fuzzy Hash: D6D15875E08154DFDB00CF68E8916BEBBB1AF0A310F5945B9E491AB392C7394D42CB68

Function 004252C9 Relevance: 2.9, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

^I, xrefs: 00425412, 00425427, 0042545C
BWB, xrefs: 004255B5, 0042572F

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: BWB$^I
API String ID: 0-2549777654
Opcode ID: d91a0ff268831ce0f77eddb8ec210d4f7ada0c105ddcf4f85a3ca2c14205d774
Instruction ID: 6261e7546a230821863048f7173daa5000af211635fbb0a6bb0669c6c4061bda
Opcode Fuzzy Hash: d91a0ff268831ce0f77eddb8ec210d4f7ada0c105ddcf4f85a3ca2c14205d774
Instruction Fuzzy Hash: 90C115366187218BC324DF28D8902BFB3A2FF95781F95882ED4C54B360EB789D45D749

Function 00426820 Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

t, xrefs: 00426AC0
-,#", xrefs: 00426872

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: -,#"$t
API String ID: 2994545307-4244866344
Opcode ID: 229e3c833b2b8964475c78d47167ca52d2439d084f2c6dd1ecbe7a2d29c346ab
Instruction ID: a9aebe5b56afe3e049e72547e7bd765a284fd7fd5f7e1678d38c564621030797
Opcode Fuzzy Hash: 229e3c833b2b8964475c78d47167ca52d2439d084f2c6dd1ecbe7a2d29c346ab
Instruction Fuzzy Hash: 6B815CB1B043604BD7189E24E85173B72A1EB91304F5AC53EE986A7385EA3C9C05878A

Function 0042DCE4 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

{_kE, xrefs: 0042DD25
{_kE, xrefs: 0042DDC0, 0042DE55

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: {_kE${_kE
API String ID: 0-2717772715
Opcode ID: bbcdc1b2f94a60b4df8c6374ad1cf3e86aca7bf1f519ebf3dfabd1ee9da8587d
Instruction ID: 106b217cfa2e512b622056828d8992983559f078a0b165afc89af8caa8af3c87
Opcode Fuzzy Hash: bbcdc1b2f94a60b4df8c6374ad1cf3e86aca7bf1f519ebf3dfabd1ee9da8587d
Instruction Fuzzy Hash: 6D414671A18BD18AD7258F34D8607FBBBE19BA6300F68897DC0C587243DA3D86468756

Function 0042DB13 Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

{_kE, xrefs: 0042DB45
{_kE, xrefs: 0042DBE0, 0042DC75

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: {_kE${_kE
API String ID: 0-2717772715
Opcode ID: 34ff8b9050b8f10efc6438b1cfc707df5db9b09c1f48f9ae82cd249ee2f998c2
Instruction ID: 680bf760e010de30ed7228732937ae52c7ffd5be9ce1a2573546d8610f35cc39
Opcode Fuzzy Hash: 34ff8b9050b8f10efc6438b1cfc707df5db9b09c1f48f9ae82cd249ee2f998c2
Instruction Fuzzy Hash: 3E4143756087828AD729CF35C8B07FBBBD29FE2300F28857DC0C587292DA3D4906871A

Function 0040E030 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

-,#", xrefs: 0040E050
:YV, xrefs: 0040E0E0

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: -,#"$:YV
API String ID: 2994545307-3668490761
Opcode ID: 5730e5fe9a95d66c409bcf149896b09d6e84f6d2c3e27ffaf2ec9f11f695c7a2
Instruction ID: 4c14ded29eb26185c99260fbabd770f49526a3863f3675bc8def07179c7703e4
Opcode Fuzzy Hash: 5730e5fe9a95d66c409bcf149896b09d6e84f6d2c3e27ffaf2ec9f11f695c7a2
Instruction Fuzzy Hash: 863113306142418BEB29CB14DC61FBB73D2EBC5300F18CC7DD482A7291E7B9A871875A

Function 0042C6E3 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

LNua, xrefs: 0042C759
N, xrefs: 0042C6F9

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: LNua$N
API String ID: 0-1541665044
Opcode ID: b737bd3dd6e32e2df6477e3c3192376af311689c2f59e612a5a63c000a4ee03d
Instruction ID: 1ee2d171fc8bd0a4103a0d81042818f3e1644da498355e6e93c4422dc14832fe
Opcode Fuzzy Hash: b737bd3dd6e32e2df6477e3c3192376af311689c2f59e612a5a63c000a4ee03d
Instruction Fuzzy Hash: 9511CC65B492864BD72C8E36856237BBB9367D6244F1CD57E80C7DB2C5CD7888018B19

Function 00423026 Relevance: 1.8, Strings: 1, Instructions: 524COMMON

Download Yara Rule

Strings

3B, xrefs: 0042342E

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: 3B
API String ID: 0-2290667792
Opcode ID: 84a4ee922267f05583ab3baf4c6f82e035a8e8dca2e17496911291d6a3655118
Instruction ID: 23e9220e78e4661e87bfa01708843d785bef23cbfdf35017992a8e00720886c6
Opcode Fuzzy Hash: 84a4ee922267f05583ab3baf4c6f82e035a8e8dca2e17496911291d6a3655118
Instruction Fuzzy Hash: 49F1E03AA08211DFD314CF28EC4176AB3E6FF8A311F5A8978E88597351D738E915CB46

Function 00422220 Relevance: 1.7, Strings: 1, Instructions: 487COMMON

Download Yara Rule

Strings

ur, xrefs: 00422248

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: ur
API String ID: 0-2912587612
Opcode ID: 31f576ef0ceb3f7428a20a1d1d5355891968e4bc38a6e5a1aec70bb31c5a11dc
Instruction ID: 2933f4288af0fb302d4865e900e940e971ef474701bc337b8faf9ee79d554df2
Opcode Fuzzy Hash: 31f576ef0ceb3f7428a20a1d1d5355891968e4bc38a6e5a1aec70bb31c5a11dc
Instruction Fuzzy Hash: C8D16872B042209BD714DF28DD8177BB3A2EF95314F48843DE885DB385E6BCD905836A

Function 00439870 Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

nhi, xrefs: 00439B70

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: nhi
API String ID: 2994545307-409182551
Opcode ID: 1b0a3cd9f1b598a48d14ad56fee4aa29d6910067838cf3c26b842d3dac0edce5
Instruction ID: 7a378b07afe0dce26b9d9a3c36de4d4d68de02c10dbf071a982f307c88a13559
Opcode Fuzzy Hash: 1b0a3cd9f1b598a48d14ad56fee4aa29d6910067838cf3c26b842d3dac0edce5
Instruction Fuzzy Hash: 22C157356083009BD714DF14D88062BFBE2EBCA714F19A62EE8D557352D375EC42C79A

Function 00440C30 Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

$' !, xrefs: 00440D5D, 00440E57

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: $' !
API String ID: 2994545307-3942351852
Opcode ID: 0b713519264c8b4c3629f2ca0a5c2cc84980b6adbb0a1f4f1c441d845cf26e62
Instruction ID: 4404b311211fdacfee075cf533346b075d8bf1841094ab771d77e339acbd6935
Opcode Fuzzy Hash: 0b713519264c8b4c3629f2ca0a5c2cc84980b6adbb0a1f4f1c441d845cf26e62
Instruction Fuzzy Hash: A9C13673B183108BD328CF28D88166BB7E2EBD4304F19C63ED99597355DA799C058BC5

Function 0042A630 Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

", xrefs: 0042A918

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 393eaf58cb1cfc9012c1a5ed4da3559b2f8e8deac801884b4497616f30de6584
Instruction ID: 4ebb3f018987efa2ad535bff4804068c5748c9a0a400f43f4360d55faff2b568
Opcode Fuzzy Hash: 393eaf58cb1cfc9012c1a5ed4da3559b2f8e8deac801884b4497616f30de6584
Instruction Fuzzy Hash: B0D103B2B083205BC714DE25A48176BB7E9AF85314F49892EEC8987382D73CDD19C797

Function 00440810 Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

yiP, xrefs: 00440951

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID: yiP
API String ID: 2994545307-2938885043
Opcode ID: e03020ff3574e976498d7acc434cb22d94adcc0a28a3418f4a27b62f2c71e960
Instruction ID: ff28010e13dd69ee72a1a312e6391d215d807f9c4b7ae5993c5cddc4e05c5cc0
Opcode Fuzzy Hash: e03020ff3574e976498d7acc434cb22d94adcc0a28a3418f4a27b62f2c71e960
Instruction Fuzzy Hash: DBC10572B043119FD728CF68C88162BF3A2FF98304F19892DEA959B355DB34AC51CB85

Function 00422750 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

v, xrefs: 0042281C

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-38809212
Opcode ID: 0c3135aae97535b4c06561675acfe575cedb906622af2d10bf09011f14f4f53d
Instruction ID: eb6297aafcaf11b804a74dda3c3ef3e397b02d7c5bad6293a538c3f01507e569
Opcode Fuzzy Hash: 0c3135aae97535b4c06561675acfe575cedb906622af2d10bf09011f14f4f53d
Instruction Fuzzy Hash: EA5114A2B0422057DB149F28DD92777B2E0EF95324F49962EE8868B381F6BCD905C319

Function 004258CC Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

7[B, xrefs: 00425B31

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: 7[B
API String ID: 0-536383012
Opcode ID: 5537dd6dd1634ac47b585ad78762a7d495399c92b0bdf477a34b707034bc0e25
Instruction ID: 4fd3cb6b5fbc0d59b62a4fb911a8d9cf10673666e104ac24502c3f738b8bf350
Opcode Fuzzy Hash: 5537dd6dd1634ac47b585ad78762a7d495399c92b0bdf477a34b707034bc0e25
Instruction Fuzzy Hash: 43516671748B668FD7248A6498822BBB7E1EF45310F88493FD4C68B341D23CD94AE74A

Function 004151B0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

UNA, xrefs: 00415600

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: UNA
API String ID: 0-4195821252
Opcode ID: d229a3544778723d81a28f9904d69e9f18078472be1c668a810d95b17c139d3b
Instruction ID: 1d58e1569f8ec2afc007d13b825b6e6dd63d5ba794a463b4467fe4491c662bdf
Opcode Fuzzy Hash: d229a3544778723d81a28f9904d69e9f18078472be1c668a810d95b17c139d3b
Instruction Fuzzy Hash: 7321F235608600DBE7189B18D4919FB7362EB96314FA8512EC0C7432A1D72AAC938B8E

Function 00429211 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

^&, xrefs: 0042921D

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: ^&
API String ID: 0-3085756376
Opcode ID: 75475964bd3477677ccedb9ffdd39a38b3dec7795d1b7ee7cb60190800a84723
Instruction ID: 64fc3f53591b1f4e61f0878363cd3e2d37a1ed4fb8fcd381d9c574d41a3b9d54
Opcode Fuzzy Hash: 75475964bd3477677ccedb9ffdd39a38b3dec7795d1b7ee7cb60190800a84723
Instruction Fuzzy Hash: 1501D8556081709ADB254E2E64A0372BAD15F5B310FA89CDA98D69F356C42E8C06837D

Function 0043EB88 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

t, xrefs: 0043EB8F

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 8a03b1ec058f6693e5b65694a2d8a0b4df41d7527cafbab5a75dc1862957c3c4
Instruction ID: 63e19db0f93a6dae8dfe54e53388dca3ed4eaeb3abcc72c9ba12e90d7f9c35e1
Opcode Fuzzy Hash: 8a03b1ec058f6693e5b65694a2d8a0b4df41d7527cafbab5a75dc1862957c3c4
Instruction Fuzzy Hash: 3EF02436B966208BCB00CF68C88854BF79197DF220F1EDB28CDA8A3292D135DC01C7C8

Function 0043F540 Relevance: .7, Instructions: 727COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9a8fc6b89ea236dbdb387b43ba291911e32f2680c21128f7e831be2c03d844
Instruction ID: 54daf3b579ebbd9c2a4c485f9b9f0cfc24f3438be34c7e90d28da51edff2fb07
Opcode Fuzzy Hash: 6c9a8fc6b89ea236dbdb387b43ba291911e32f2680c21128f7e831be2c03d844
Instruction Fuzzy Hash: B7223539A58211CFDB04CF78E89026AB7E2FF8E315F0984BEC54693361D735A915CB45

Function 0043F660 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a49a78ebe6b168f75700f4a926b9b8671c02ec73cf96d90de36a6035fbf6a
Instruction ID: 1c723d45031e0e5f2b9b358dbf3ef3a8914302c4682d4508a80e5e4c1951da74
Opcode Fuzzy Hash: 937a49a78ebe6b168f75700f4a926b9b8671c02ec73cf96d90de36a6035fbf6a
Instruction Fuzzy Hash: F612233AA58211CFDB04CF78E8D066AB7E2FB8E315F1984BDC54693361C735A826CB45

Function 00407410 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e15bf933866eaa341b681c485ccf4360e05fc4ee0e32aeaaf304759d2d656c
Instruction ID: c92edf3822012b181dadebb06f7edb043bbaa9d7c48d59259f3166036ecb0ce2
Opcode Fuzzy Hash: 39e15bf933866eaa341b681c485ccf4360e05fc4ee0e32aeaaf304759d2d656c
Instruction Fuzzy Hash: CB22A272A087118BC725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B8118B47

Function 0043F67B Relevance: .6, Instructions: 615COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c980666c7bddf54fcbaaa1cb2f84cf301ae3e7cd17c971d11f26757430c2721
Instruction ID: 0f75eed81ac74744bca2bac3eb1a8791e799e4bb3c72ea2c237a37cd6386018b
Opcode Fuzzy Hash: 6c980666c7bddf54fcbaaa1cb2f84cf301ae3e7cd17c971d11f26757430c2721
Instruction Fuzzy Hash: E612353AA58211CFD704CF78E8D026AB7E2FB8E315F1985BDC54693361C735A826CB45

Function 0043F679 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238084d3e0fad662479d891e59f613a82f78f79269ff8fb19cdaf09971159ce9
Instruction ID: 6a754d8a11583ac54e741eded095c1c474aeba31e1be645f0912a5aa444e5f33
Opcode Fuzzy Hash: 238084d3e0fad662479d891e59f613a82f78f79269ff8fb19cdaf09971159ce9
Instruction Fuzzy Hash: FC02353AA58211CFDB04CF78E8D026AB7E2FB8E315F1985BDC54693361C735A826CB45

Function 0043F7A0 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075f09d52398d66b3f8d2166165783d790a62c8dbc59de06c9f4ba8a3d4805a2
Instruction ID: 8e958c2056480958870c86ab2f3638465bec954b0afc82d14ac17241f5cef311
Opcode Fuzzy Hash: 075f09d52398d66b3f8d2166165783d790a62c8dbc59de06c9f4ba8a3d4805a2
Instruction Fuzzy Hash: F0F1123AA54210CFCB08CF68E8A06AAB7F1FF8E315F1985BDC54693361C735A925CB45

Function 00440400 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a0b4b965cefa7c4a318816bcd1b3440dffea0772bd1aa3ddb21a6cf56576b978
Instruction ID: dd418fe4fcc3ca0d9ab87274fd3e2617155efbf9efa21ba67bef0ff5882d2538
Opcode Fuzzy Hash: a0b4b965cefa7c4a318816bcd1b3440dffea0772bd1aa3ddb21a6cf56576b978
Instruction Fuzzy Hash: B5B16D366053158FD728CF29C891A2BB3A2FFD4714F1A842DD9858B355DB34EC21CB86

Function 00421E40 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b33abb2e4bf76fb2f2774c35ea0a2e4be881f125bd6cfe93d698b498cc0e6b
Instruction ID: 1bada7c2ac2b9ae4cfe48a4508fb2ef94e887998e87eb0a52497d20bb3571013
Opcode Fuzzy Hash: 40b33abb2e4bf76fb2f2774c35ea0a2e4be881f125bd6cfe93d698b498cc0e6b
Instruction Fuzzy Hash: 5FA134B2A043209BC710DF64DC91B6B73E4FF94318F09492DEA858B391E7B8E905C75A

Function 00439550 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85fe585dbba659b32c2856ffde8e60d9d0211cca1c4f44fbdcbd58ca0a4513db
Instruction ID: 2705c9769f7a3051055f0a1ab50d18170b0b37f6b75c819a9f010e4bdfa3ab23
Opcode Fuzzy Hash: 85fe585dbba659b32c2856ffde8e60d9d0211cca1c4f44fbdcbd58ca0a4513db
Instruction Fuzzy Hash: 8C71F274608300EBE7149F15D882B3B77E1FBCA304F18692DE5C557291C7B99C46CB9A

Function 00408DE0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85de29c35d6863bb30b53735a2dadbaaebed93b65f7f359fcf81152b39aa23c5
Instruction ID: 2beb2b2753566204d02ec74081a2d229c34b1dee510fb13565f54867422f629d
Opcode Fuzzy Hash: 85de29c35d6863bb30b53735a2dadbaaebed93b65f7f359fcf81152b39aa23c5
Instruction Fuzzy Hash: D4316E116857554FD7248938CA512B7B7C3CBA1360F0E477ED4916B3D2DA2C8908D39D

Function 0042B766 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e478691cc04ce96ce516819353fbfc411e543a4100e61be53017c37d36c2087c
Instruction ID: fc3bc627c4adeb52b88a14872f03d20053f08d62155146673129dfe3a96566c5
Opcode Fuzzy Hash: e478691cc04ce96ce516819353fbfc411e543a4100e61be53017c37d36c2087c
Instruction Fuzzy Hash: 6B419F242083D24BE7229B3950247BBFFE4DFA3314F6849ADC4D997282DB294506CB56

Function 0042B75C Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947dc8f3dd721a708692808d75c93bb472c8303fc19f9f8db2994205aacf456e
Instruction ID: d160a31831a885346dee611f4692063b3097ebadec09c22a963aafbfb003933a
Opcode Fuzzy Hash: 947dc8f3dd721a708692808d75c93bb472c8303fc19f9f8db2994205aacf456e
Instruction Fuzzy Hash: D031A02420C3D28BD7268B3990287BBFBE4DFA3315F68499EC4D997392C7394506CB56

Function 004310A0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b184f26457eb3768389c411b1d7d78d0e88aa143555ab874d01a191b24b704e
Instruction ID: daefbec3f1ef113ba796a1dd17346d589f42dc2f1c4db925d1c94d003abe2be7
Opcode Fuzzy Hash: 4b184f26457eb3768389c411b1d7d78d0e88aa143555ab874d01a191b24b704e
Instruction Fuzzy Hash: 7E813FF451A3858FE374DF05D5986AEBBE1FB89708F10891F948857350CBB41449CF8A

Function 00422AC9 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c0b43fae5377991f91c3740f27a5fd169fd16ca414385d425a32b96b63818b
Instruction ID: 7bb5b987e0bb4f7114b4c2212bfccdf2956b5a8d90ad284f67403ee2604ccb4d
Opcode Fuzzy Hash: 78c0b43fae5377991f91c3740f27a5fd169fd16ca414385d425a32b96b63818b
Instruction Fuzzy Hash: 7E412832B146245BC324CF29EC41767B6E2AB86318F5E8639D8D4DB355E638AC01C7D5

Function 0042B5D9 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665649c005d56b1ee58bf9e16e5146156e3f58b540e4cdf5b4f6b86b36b2c97d
Instruction ID: fd7439bc37db9c11efa221d04a04d82f9085f2ec2038449f5f4073d676576ff4
Opcode Fuzzy Hash: 665649c005d56b1ee58bf9e16e5146156e3f58b540e4cdf5b4f6b86b36b2c97d
Instruction Fuzzy Hash: F031BF242183D14AD7319B3990283FBFBE4DFA3314F68499DC4D997382CB394005CB56

Function 0042C47F Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b91613ff158a69e432da1d80dce04d2c5288efbcccb728770b7edd432d3a27
Instruction ID: 5b762966393eeb1bc0971079b6ad5409ecfaa4a6f1308e5f2f4f6a2c15d15fbe
Opcode Fuzzy Hash: 83b91613ff158a69e432da1d80dce04d2c5288efbcccb728770b7edd432d3a27
Instruction Fuzzy Hash: 3D31FC7410C3D09BD7354F246855BBBBBF0AF93304F14996DC4C997293EA39844B8B6A

Function 0040C3B4 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e044102361ce3c0fc5cf088071144cc83bc0068fc2d88a9d7a65daf08341b7c3
Instruction ID: 238b6f7397c2f693389e5af9bc4c72eef290b4da23fc4ac8245387494e53b8e9
Opcode Fuzzy Hash: e044102361ce3c0fc5cf088071144cc83bc0068fc2d88a9d7a65daf08341b7c3
Instruction Fuzzy Hash: FD21D377F505258BDB24CF68CC817AF77F6AB8A200F1A8179D945FB349D6349C0187A4

Function 00435A00 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: e6a8dc17c880850e49dd7e1e966283a5207de34a9f0a067377e85bee35f7d401
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 36115933A055D40EC3129D3C8440565BFA31AA7234F68939AF0F99B2D2C2268D8AA358

Function 0042A010 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57814f194fff62bd8a5d8ba9d633bff23d04ecfb4f06fea282807f61cd4543f2
Instruction ID: d2294d5950415ddc2e4667efe40a2cfd01bb94c476222eaec0709288821d6307
Opcode Fuzzy Hash: 57814f194fff62bd8a5d8ba9d633bff23d04ecfb4f06fea282807f61cd4543f2
Instruction Fuzzy Hash: 4F01B5F1B0071147D720AE11A4D0B2BB2A86F85708F09053EDD4867342DB7EEC2882AA

Function 00402BB0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3392263a2fef94f1e7939ba329bd131c45995f9e6f47d9558bbdcacaaa272e9
Instruction ID: dda0d9bfc2e162cbf5eda5eae9bd46ae3be84b7a229878372f346e270daa3058
Opcode Fuzzy Hash: a3392263a2fef94f1e7939ba329bd131c45995f9e6f47d9558bbdcacaaa272e9
Instruction Fuzzy Hash: 5AF0593B7192150BE310CD69EDC4A6FB366DBD6304B0A413EE940E3380C4B5E80582A8

Function 00420FC3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa107ba09682016c9b76acaf3258e1c4cc52b82e7effe948d11587081b75557
Instruction ID: 83f1021beb35e139e6bfc2a106445938dbd31eca8b46081d04e1f7767ff24d26
Opcode Fuzzy Hash: afa107ba09682016c9b76acaf3258e1c4cc52b82e7effe948d11587081b75557
Instruction Fuzzy Hash: D1B092A9C0282086E2113F113E125AFB0244913308F07243AE84A32243AA2AE21E40AF

Function 00427EEB Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82cf270e24139fb2dbbb044742abb91ec97ae5af65658d3ec5f6a1ce25279dc
Instruction ID: a7b8390af064a98c08a839ecacb7d952fd914323f07ae51c8131dd1cf4d90b35
Opcode Fuzzy Hash: b82cf270e24139fb2dbbb044742abb91ec97ae5af65658d3ec5f6a1ce25279dc
Instruction Fuzzy Hash: 70B01274E0819043C200EF145591077B1344647208F157874D45CB7202DA35EC0582DD

Function 00431CC9 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 90COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00431D0F

Strings

{, xrefs: 00431D4C
k, xrefs: 00431DCC
a, xrefs: 00431D7C
g, xrefs: 00431DAC
e, xrefs: 00431D9C
i, xrefs: 00431DBC
m, xrefs: 00431DDC
}, xrefs: 00431D5C
o, xrefs: 00431DEC
n, xrefs: 00431DE4
c, xrefs: 00431D8C
y, xrefs: 00431D3C

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: InitVariant
String ID: a$c$e$g$i$k$m$n$o$y${$}
API String ID: 1927566239-2118003515
Opcode ID: 9aa8f35111fac5fe297951e9d2466ba43fe60ce96983b98d2ecea7c7913200d3
Instruction ID: 77cf041c9802ef4b395f62e61a9853e452b7bf42cb9497ebf068d1f4ce3eb5e8
Opcode Fuzzy Hash: 9aa8f35111fac5fe297951e9d2466ba43fe60ce96983b98d2ecea7c7913200d3
Instruction Fuzzy Hash: D641E32050C7C18AD331DB68C45879EBFD1AB96324F088E9ED4DAAB3D2C7794145C767

Function 0086AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0086AACD,?,?,?,?,?,?,?,?,?,?), ref: 0086AB88
__alloca_probe_16.LIBCMT ref: 0086AC43
__alloca_probe_16.LIBCMT ref: 0086ACD2
__freea.LIBCMT ref: 0086AD1D
__freea.LIBCMT ref: 0086AD23
__freea.LIBCMT ref: 0086AD59
__freea.LIBCMT ref: 0086AD5F
__freea.LIBCMT ref: 0086AD6F

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 9e90af216ea03829b75e3c5b610120fb989df9efffd49569696334b6ecff83b7
Instruction ID: 8e0b55463e6248a38277106ee54ee0b0350ba9ebb4e56873f02078d3a519e7b1
Opcode Fuzzy Hash: 9e90af216ea03829b75e3c5b610120fb989df9efffd49569696334b6ecff83b7
Instruction Fuzzy Hash: F571D5729002095BDF299E588C82FAF77AAFF45311F2A0459E904F7292E735DC408F62

Function 0084FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0084FE70
__alloca_probe_16.LIBCMT ref: 0084FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0084FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0084FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0084FF37
__alloca_probe_16.LIBCMT ref: 0084FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0084FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0084FFB9

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: dabbc6a59a75c8ff5a77da1d0a5d5dbe0431109648e13674a2186b9f558bc5b7
Instruction ID: 7565c1599bb706a61ffa3fb40e5cce57130087cbc98db01700f48b60f0a0a794
Opcode Fuzzy Hash: dabbc6a59a75c8ff5a77da1d0a5d5dbe0431109648e13674a2186b9f558bc5b7
Instruction Fuzzy Hash: 3051AC7260061EAFEB204F64CC45FAA7AA9FF41754F14443AFA15DA192EF31DC148B50

Function 0085EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0085EEFC

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: ffd80e9ee20b2a9fb9c11de681e34130eb2cfed883c18e532ea14b5d668ce91b
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: CCB15672A006559FDB168F28CC81BAE7BA6FF15311F1841A5EE44EB283D7709909C7A1

Function 00427516 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 229COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427850
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004278DA

Strings

lzB, xrefs: 004278FD
X{, xrefs: 0042779C
EP, xrefs: 004277AC
qF, xrefs: 004277B4

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: EP$X{$lzB$qF
API String ID: 237503144-2164892811
Opcode ID: de90abcc1a233ca89d5823499507d934d77944f9a7fc1bde9ac41d3286d94b89
Instruction ID: 8c1cc06ba9b792a8fb3a059e159ca77235b5a1f59c4008dbcd262fde911c94cc
Opcode Fuzzy Hash: de90abcc1a233ca89d5823499507d934d77944f9a7fc1bde9ac41d3286d94b89
Instruction Fuzzy Hash: 0F61E0B560C3409FE320DF65A841B1FB7E4EB89314F44093DF688A7292DB74D9068B9B

Function 00427762 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 222COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00427850
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004278DA

Strings

lzB, xrefs: 004278FD
X{, xrefs: 0042779C
EP, xrefs: 004277AC
qF, xrefs: 004277B4

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: EP$X{$lzB$qF
API String ID: 237503144-2164892811
Opcode ID: 4ddd4795b010ec054398b5b300bd2244ef639b636111aa00c5574035a8958b47
Instruction ID: b447fc908ed6bea55d5f597dfcfbd1ce4d15ffc20013b0c9ec9b8519fe6b09b3
Opcode Fuzzy Hash: 4ddd4795b010ec054398b5b300bd2244ef639b636111aa00c5574035a8958b47
Instruction Fuzzy Hash: 5C61F0B960C3409FE320DF65A841B1FB7E4EB89314F44493DF688A7292DB74D9068B5B

Function 00850D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00850D77
___except_validate_context_record.LIBVCRUNTIME ref: 00850D7F
_ValidateLocalCookies.LIBCMT ref: 00850E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00850E33
_ValidateLocalCookies.LIBCMT ref: 00850E88

Strings

csm, xrefs: 00850E1D

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 67cfcf2f67d1982406d88c2b39878092ba533d3f816ce973650fec629aef71d9
Instruction ID: 8394991d1e9810481efe7d32f85de05158384173395e63eef8bd0a6c7777d804
Opcode Fuzzy Hash: 67cfcf2f67d1982406d88c2b39878092ba533d3f816ce973650fec629aef71d9
Instruction Fuzzy Hash: 0741BF34A0021C9BCB11DF68C886A9EBBB5FF44326F248555ED18EB352D731EA19CF91

Function 008424B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 008424DD
ShowWindow.USER32(00000000,00000000), ref: 008424E6
GetCurrentThreadId.KERNEL32 ref: 00842524

Part of subcall function 0084F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0084253A,?,?,00000000), ref: 0084F129
Part of subcall function 0084F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0084253A,?,?,00000000), ref: 0084F142
Part of subcall function 0084F11D: CloseHandle.KERNEL32(?,?,?,0084253A,?,?,00000000), ref: 0084F154

std::_Throw_Cpp_error.LIBCPMT ref: 00842567
std::_Throw_Cpp_error.LIBCPMT ref: 00842578
std::_Throw_Cpp_error.LIBCPMT ref: 00842589
std::_Throw_Cpp_error.LIBCPMT ref: 0084259A

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: f6099d7a0185e96b0963cc9b0def0325f88aa707fb77a9ea9135dbc3ec0b81e2
Instruction ID: f8511f5c5e5a0dcae8641e89337dd6ff003e0cca403118cfd33b0e745babe19a
Opcode Fuzzy Hash: f6099d7a0185e96b0963cc9b0def0325f88aa707fb77a9ea9135dbc3ec0b81e2
Instruction Fuzzy Hash: 022165F2D402199BDF50AF989C06BDEBAB8FF04710F080125F508BA281E7B69554CAA6

Function 0085CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,0085D01A,00841170,0084AA08,?,?), ref: 0085CFCC

Strings

ext-ms-, xrefs: 0085CF76
api-ms-, xrefs: 0085CF62

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ee2dd7927d2b69e597809ce3356e04a1992367e3fd8a2fad44404c7c3224fa0f
Instruction ID: 7741afd81dbcc9bc415d88d1889869411c33fc860d0bfc8b6b5f99148347a4d2
Opcode Fuzzy Hash: ee2dd7927d2b69e597809ce3356e04a1992367e3fd8a2fad44404c7c3224fa0f
Instruction Fuzzy Hash: 5F210531A01711AFC7328B64DC44A5A7B6AFF81765F250111ED4AE7290EFB0ED18CED0

Function 00850080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00850086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00850094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 008500A5

Strings

GetTempPath2W, xrefs: 0085009A
GetSystemTimePreciseAsFileTime, xrefs: 0085008E
kernel32.dll, xrefs: 00850081

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 8ddf476b87f744c9096d092ba4cb82525907381bb3fe4a6ebaaaf14de3b064c7
Instruction ID: a1151405b8d3bba0d8d623cb5f3ba1806b8b4f433c149dc9397c29aba437d173
Opcode Fuzzy Hash: 8ddf476b87f744c9096d092ba4cb82525907381bb3fe4a6ebaaaf14de3b064c7
Instruction Fuzzy Hash: F6D05E31901610AB83116F747C0C8893EA8FB493003018056F41CE236CEFB4C6808A56

Function 00864F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7da60a23438163266ba71436117946b0ba27bb43281e7602817920f601621e
Instruction ID: ec8b566f03af00234c07599887eecc08124a5f8de394b3053bf1926a9c5f8169
Opcode Fuzzy Hash: cc7da60a23438163266ba71436117946b0ba27bb43281e7602817920f601621e
Instruction Fuzzy Hash: 84B11370A08B49AFDB11CFACD895BAEBBB0FF56304F154158E904EB382C7719941CBA1

Function 00849B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00849C97
std::_Throw_Cpp_error.LIBCPMT ref: 00849CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00849CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00849CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00849CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00849D06

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 0d79655c0c9ff423635665d9957c9813654c8d18fd9e9771b03296f9cc85d337
Instruction ID: 87084ab2bfdff2e1d399b236652676e21c036c9dabf72edbbc2a99c9cad2f039
Opcode Fuzzy Hash: 0d79655c0c9ff423635665d9957c9813654c8d18fd9e9771b03296f9cc85d337
Instruction Fuzzy Hash: B441D3B1900748CBDB309F6989417ABBBF4FF45324F18062DD5BAA62D1D770A504CB93

Function 0085ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0085ACDE,00850760,0084B77F,BB40E64E,?,?,?,?,0086BFCA,000000FF), ref: 0085ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0085AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0085AD1C
SetLastError.KERNEL32(00000000,?,0085ACDE,00850760,0084B77F,BB40E64E,?,?,?,?,0086BFCA,000000FF), ref: 0085AD6E

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c4633c16fa3398c85998db5d73e5c203f6e5a669f93a68ab04de857bfa5fca5b
Instruction ID: 6a94944a78c72d0ae4d9be77d329c3c9a7b13f5b52f7c72d804d4ba6a1d2f690
Opcode Fuzzy Hash: c4633c16fa3398c85998db5d73e5c203f6e5a669f93a68ab04de857bfa5fca5b
Instruction Fuzzy Hash: 40016D322096199DA72836787CC9A262E99FF00B77724033AFE24C21F0FF118C475142

Function 0085B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0085B68D
CallUnexpected.LIBVCRUNTIME ref: 0085B906

Strings

csm, xrefs: 0085B6C4
csm, xrefs: 0085B618
csm, xrefs: 0085B5AB

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: aa0b98058874e0546a88a25fe6eb86df4efbf1fe65d34d39256881cec065bdf2
Instruction ID: 4f11c0ed463ec0917201e8b132d15928015408b1479def2b393cc6b5e1035965
Opcode Fuzzy Hash: aa0b98058874e0546a88a25fe6eb86df4efbf1fe65d34d39256881cec065bdf2
Instruction Fuzzy Hash: C0B16F75800209EFCF19DFA8C8819AEBBB5FF24312F144569EC11AB212D731D959DF92

Function 0084BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0084BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0084C028

Strings

RCC, xrefs: 0084BEAB
csm, xrefs: 0084BEB7
MOC, xrefs: 0084BE9F

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: af7b553cfcdd8074c1caa713089d2a31714c37a3bdeebc4aeea2329465f8725a
Instruction ID: 2364f2b7f6480c62394ea54379989a67db7c0755fdc40f06a14248d2f602f8ef
Opcode Fuzzy Hash: af7b553cfcdd8074c1caa713089d2a31714c37a3bdeebc4aeea2329465f8725a
Instruction Fuzzy Hash: EF41C934901208DFCF28DF68C9419AEB7B9FF58300B5880ADE449E7642CB34EA08CB52

Function 008555C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0086BE94,000000FF,?,00855685,0085556C,?,00855721,00000000), ref: 008555F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0085560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0086BE94,000000FF,?,00855685,0085556C,?,00855721,00000000), ref: 0085562D

Strings

CorExitProcess, xrefs: 00855603
mscoree.dll, xrefs: 008555F2

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 53d2289de237f6142a500a2b1413ccfc2e9cc84a31f5377a07263111a7faafe2
Instruction ID: 1882ae83fdef3183f2442d3d42dc118c16f96c0c2a909b7cc11b6dd07e45e09e
Opcode Fuzzy Hash: 53d2289de237f6142a500a2b1413ccfc2e9cc84a31f5377a07263111a7faafe2
Instruction Fuzzy Hash: C701DB31A00A55AFDB128F44CC09BAEB7F8FB44715F004525F825E2294EB78D944CA50

Function 0085D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0085D76F
__alloca_probe_16.LIBCMT ref: 0085D838
__freea.LIBCMT ref: 0085D89F

Part of subcall function 0085BF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0084A67D,00000018,?,00843D4A,00000018,00000000), ref: 0085BF43

__freea.LIBCMT ref: 0085D8B2
__freea.LIBCMT ref: 0085D8BF

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 9bdda93d43c219a9bca942ca8d2e0b984dfb3a6a7b1a238a1e5567bdc80f35eb
Instruction ID: 60fdd974f5626eca6d07cc6dca985bdd0e7f262065b3bb555b4f858f3e9a90a0
Opcode Fuzzy Hash: 9bdda93d43c219a9bca942ca8d2e0b984dfb3a6a7b1a238a1e5567bdc80f35eb
Instruction Fuzzy Hash: 0151927260030AAFFB319F64CC81EBB7AA9FF44752B150939FD04DA251EB70DC5896A1

Function 0084EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0084F005
AcquireSRWLockExclusive.KERNEL32(00848E38), ref: 0084F024
AcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F052
TryAcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F0AD
TryAcquireSRWLockExclusive.KERNEL32(00848E38,0084A2F0,?), ref: 0084F0C4

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 8e9c77e5f0ebecc6147192c2b0d2992ba5c5ba1df93278ebfdfbf0f0066d730a
Instruction ID: e9b8049a466507a30e907bdbf78ac5b654dc916a9e8260926d2c88c0cb71bcbc
Opcode Fuzzy Hash: 8e9c77e5f0ebecc6147192c2b0d2992ba5c5ba1df93278ebfdfbf0f0066d730a
Instruction Fuzzy Hash: 93412271900A0EDFCB25CF65C4849AAB3B5FF88315B20492EE65AC7943E730E985CB52

Function 00843C70 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00843CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00843CE0
__Getctype.LIBCPMT ref: 00843D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00843DD8

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: edb6f5c989c180fe33390f35db88627d5fc8b4e41c3aa848cc17045cc1386596
Instruction ID: c943cce74b4f54a329b2b98dbbc9f708b1ade9b64d59f99c4568610334a73f93
Opcode Fuzzy Hash: edb6f5c989c180fe33390f35db88627d5fc8b4e41c3aa848cc17045cc1386596
Instruction Fuzzy Hash: 57414A71E002188FCB14DF98D845BAEBBB1FF58720F148119D829AB395DB35AE45CF91

Function 0084D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0084D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0084D4D3
int.LIBCPMT ref: 0084D4EA

Part of subcall function 0084C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0084C1F6
Part of subcall function 0084C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0084C210

codecvt.LIBCPMT ref: 0084D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0084D544

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 64eed041b6678f7be20db7a6b629c49c0c0b89a0446227025d2ff5eba4b65917
Instruction ID: 6dcd7cbeeded4cbe060430c9a2e573b06801fc2d3a67eebf487b1fb5639a0f6e
Opcode Fuzzy Hash: 64eed041b6678f7be20db7a6b629c49c0c0b89a0446227025d2ff5eba4b65917
Instruction Fuzzy Hash: 1901613190022D9BCB05EBA88915AAEBBB5FF84724F154419E915EB292DF749E40CB83

Function 0084ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0084ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0084ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0084AE57

Part of subcall function 0084ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0084ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0084AE04
_Yarn.LIBCPMT ref: 0084AE1A

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: af1da5c2393802aa48dee107a508669859d2fe62bc633dfcb5991d8e2e3ff2f8
Instruction ID: 4d77a58cc0cc8b593d488be1ecf17fcdbd701f6121778b848d04bed5ae6f7cdf
Opcode Fuzzy Hash: af1da5c2393802aa48dee107a508669859d2fe62bc633dfcb5991d8e2e3ff2f8
Instruction Fuzzy Hash: 8401D475A402249BCB0AEF28D85557D7B71FF84750B04401DE915DB382CF38AE82CB83

Function 00841750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00841783

Strings

ios_base::eofbit set, xrefs: 00841BEA
ios_base::badbit set, xrefs: 00841BFA, 00841C20
ios_base::failbit set, xrefs: 00841BEF

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 4bf595a20f04a3e9d9fcaf53d315e2c5fd1d27dda8c28990d9925e1689b7f27d
Instruction ID: d16e7a31855a8b84a29d661e73eac7f0de690743ebe7f775972d55d5bd27a13e
Opcode Fuzzy Hash: 4bf595a20f04a3e9d9fcaf53d315e2c5fd1d27dda8c28990d9925e1689b7f27d
Instruction Fuzzy Hash: DBF13B75A006188FCF14CF68C498BADBBF1FF88324F194269E819AB395D774AD45CB90

Function 0084B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0084B809

Strings

csm, xrefs: 0084B7A1
RCC, xrefs: 0084B795
MOC, xrefs: 0084B789

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f5c39e9f1fea5ba7eb4b1792c54c1a2ff34d25d5ef1f5812f1edf9f387d2e370
Instruction ID: 1db18e1a61b6c98d5ecb49640332d98d9b72544e5678fcb5c90000ea0dc95de3
Opcode Fuzzy Hash: f5c39e9f1fea5ba7eb4b1792c54c1a2ff34d25d5ef1f5812f1edf9f387d2e370
Instruction Fuzzy Hash: DC21B03590060DDFCF289FA8C895B6AB7ACFF44761F14492EE451C7690DB34EA40CA82

Function 00866940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,008669DC,00000000,?,0087D2B0,?,?,?,00866913,00000004,InitializeCriticalSectionEx,00870D34,00870D3C), ref: 0086694D
GetLastError.KERNEL32(?,008669DC,00000000,?,0087D2B0,?,?,?,00866913,00000004,InitializeCriticalSectionEx,00870D34,00870D3C,00000000,?,0085BBBC), ref: 00866957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0086697F

Strings

api-ms-, xrefs: 00866964

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 02afe2d533ee4fa7faddf8aec972468e6d5592aeaa4f093cf3a91bd072520106
Instruction ID: da3ca9d5d2a55830cf8bbffd50ee032d48ccbc967be2c21ef5db7eb71d22aa1e
Opcode Fuzzy Hash: 02afe2d533ee4fa7faddf8aec972468e6d5592aeaa4f093cf3a91bd072520106
Instruction Fuzzy Hash: 5FE0E570390A44BAEA211A64EC0AB693F55FF50B91F154824FD4DEC4A4FB72E8B09944

Function 00863F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00864001

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00864253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00864299
GetLastError.KERNEL32 ref: 0086433C

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 47289ad6588489dff89dbd4f0d101212faad68e1cd480eff0d0ce474df5acab1
Instruction ID: 9cd939f8b3447cc6f587688e5f68a7234fcd0d86aed0c0b5e4067fd5d5cbd08c
Opcode Fuzzy Hash: 47289ad6588489dff89dbd4f0d101212faad68e1cd480eff0d0ce474df5acab1
Instruction Fuzzy Hash: 23D178B5E002589FCF15CFE8C884AEDBBB5FF19314F29412AE926EB351D630A941CB50

Function 0085B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0085B35C
___AdjustPointer.LIBCMT ref: 0085B37F
___AdjustPointer.LIBCMT ref: 0085B41B

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 573565ade02cbc95ec4ac0ca81cc65250fd8a1dd34ec9049183e1464322af548
Instruction ID: e2709393e3e890c916036cff81be2bc286203ab8343d6ffb8c001e31808b96f4
Opcode Fuzzy Hash: 573565ade02cbc95ec4ac0ca81cc65250fd8a1dd34ec9049183e1464322af548
Instruction Fuzzy Hash: BF51B171A046069FDB259F54C882BAABBE4FF24716F14402DED06E7391E731ED88CB91

Function 00847220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008472C5
std::_Throw_Cpp_error.LIBCPMT ref: 00847395
std::_Throw_Cpp_error.LIBCPMT ref: 008473A3
std::_Throw_Cpp_error.LIBCPMT ref: 008473B1

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 1da31b49a23766ba4e8d480f4596810a08be05ee4b4c766d2954ff21f62adefe
Instruction ID: 8f1639ea4c584642e8fe0a2905d0b0beeca53f7705142dcff3c9a3b1bb4aef27
Opcode Fuzzy Hash: 1da31b49a23766ba4e8d480f4596810a08be05ee4b4c766d2954ff21f62adefe
Instruction Fuzzy Hash: 8241E4B190470D8BDB20DF68C841B6AB7A8FF44324F544639D856D7791EB30E814CB92

Function 00861DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

GetLastError.KERNEL32 ref: 00861E2A
__dosmaperr.LIBCMT ref: 00861E31
GetLastError.KERNEL32 ref: 00861E6B
__dosmaperr.LIBCMT ref: 00861E72

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c04392565d7ccfe4e5f2df1f95739b7b83a74919ffbd929f93d0d22307565302
Instruction ID: 5c22f4848325da1e66ac7e1984b4e62f2a79f1988ae1b452ee10c21378ddf6bb
Opcode Fuzzy Hash: c04392565d7ccfe4e5f2df1f95739b7b83a74919ffbd929f93d0d22307565302
Instruction Fuzzy Hash: A9210471604615AFDF20AF69D88882BB7A9FF04365B1A8518FC19D7102EB32EC008BA1

Function 00852BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e889a88568e0af3f974d35f9a9fb9eba23f0cb0e7120be4c9970dba6cdb7364d
Instruction ID: 4321b4934a9d5db10b65c023e3cdf068b8f56929bd56d8cb95d5db10b7833848
Opcode Fuzzy Hash: e889a88568e0af3f974d35f9a9fb9eba23f0cb0e7120be4c9970dba6cdb7364d
Instruction Fuzzy Hash: 0721CD31204619AF9B21AF6D9C8092A77A9FF52366B108514FC59D7252EF30EC488BA2

Function 008631BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008631C6

Part of subcall function 0085C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0085D895,?,00000000,-00000008), ref: 0085C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 008631FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0086321E

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4be9ee660e87e92326fb1013d4ca1fbb5387e85ac65ee5c81c93eaaf2e97736a
Instruction ID: ec70f1144b93b44245240a66ec8d23683ae4b395a0bbe732083154ed3c39a25c
Opcode Fuzzy Hash: 4be9ee660e87e92326fb1013d4ca1fbb5387e85ac65ee5c81c93eaaf2e97736a
Instruction Fuzzy Hash: FF1122B1500A197FAB2227B99C8ECBF7A5CFED43AA7110028FA05D1201FF64DF0485B2

Function 0086ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000), ref: 0086ADB7
GetLastError.KERNEL32(?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?,?,?,00863CD6,00000000), ref: 0086ADC3

Part of subcall function 0086AE20: CloseHandle.KERNEL32(FFFFFFFE,0086ADD3,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?,?), ref: 0086AE30

___initconout.LIBCMT ref: 0086ADD3

Part of subcall function 0086ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0086AD91,0086A2DC,?,?,00864390,?,00000000,00000000,?), ref: 0086AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0086A2EF,00000000,00000001,00000000,?,?,00864390,?,00000000,00000000,?), ref: 0086ADE8

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5904e405a97f6b55f219dbcb2de3916bff54ba2f0aa4ea7d041604095035df1a
Instruction ID: e39498b4bae4ce3d38cf19c9b4ca4ba1d9cca6a3f0f1fe3e1fdf3752ddc11ab6
Opcode Fuzzy Hash: 5904e405a97f6b55f219dbcb2de3916bff54ba2f0aa4ea7d041604095035df1a
Instruction Fuzzy Hash: F4F01C36514118BFCF221FD5DC0899A3F26FF497A2B014011FA0CA6524EB32CCA0AF92

Function 008504F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00850507
GetCurrentThreadId.KERNEL32 ref: 00850516
GetCurrentProcessId.KERNEL32 ref: 0085051F
QueryPerformanceCounter.KERNEL32(?), ref: 0085052C

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 93918f4d74c2ae9edbc3b846c7a38b6f4193ab3ef136e987e7c96cf2cd53140e
Instruction ID: c5ca3c036595d07c335f78903483485fbeaffcf756d2f3ca1e81f7a1c1b9bb61
Opcode Fuzzy Hash: 93918f4d74c2ae9edbc3b846c7a38b6f4193ab3ef136e987e7c96cf2cd53140e
Instruction Fuzzy Hash: AEF0B270D1020CEBCB00DFB4DA4898EBBF4FF1C204B914995E416E7114EB30EB948B50

Function 00423DD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,21E1270B), ref: 00423EE0
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,21E1270B,21E1270B), ref: 00423F5D

Strings

^\, xrefs: 0042401C

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ^\
API String ID: 237503144-3140518789
Opcode ID: 62c758e3dead02ed472ccd8f608285016556a712ff673435979904df779e0b61
Instruction ID: 0e20560339d99e449ab95acf06b5f11cd81112edbb507e53d608f4bdff713dde
Opcode Fuzzy Hash: 62c758e3dead02ed472ccd8f608285016556a712ff673435979904df779e0b61
Instruction Fuzzy Hash: 0AA123B4A442158FEB14CFA4EC91BAEBBB0FB41310F10816DE555AF381D7B8994BCB84

Function 008473E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00847526
___std_exception_copy.LIBVCRUNTIME ref: 00847561

Part of subcall function 0084AF37: CreateThreadpoolWork.KERNEL32(0084B060,00848A2A,00000000), ref: 0084AF46
Part of subcall function 0084AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0084AF53

Strings

Fail to schedule the chore!, xrefs: 00847551, 00847560

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!
API String ID: 3683891980-3313369819
Opcode ID: 3da7ade6cc48d0d7cac70c55379796721b36cdc1b27cec9a71ad93d08af55c9a
Instruction ID: 15a08646072fed8d983a9402460bf577e83f863a8110990fa2b03798ad0b5e57
Opcode Fuzzy Hash: 3da7ade6cc48d0d7cac70c55379796721b36cdc1b27cec9a71ad93d08af55c9a
Instruction Fuzzy Hash: 51518EB1D01218DFCB05DF94D844BAEBBB5FF08314F144129E919AB391E775A909CF92

Function 0085B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0085B893,?,?,00000000,00000000,00000000,?), ref: 0085B9B7

Strings

RCC, xrefs: 0085B9D1
MOC, xrefs: 0085B9C9

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ca237f43803cc8c9d289ac796753cd13ff6f19764a1ec8d7e5a43d327a062224
Instruction ID: 1bb224d1f7bdcc7be1e6c0418859cb4e7f02a181e0d2ea184ce082d08810d7e2
Opcode Fuzzy Hash: ca237f43803cc8c9d289ac796753cd13ff6f19764a1ec8d7e5a43d327a062224
Instruction Fuzzy Hash: 22417832900219AFCF16DF98CC81AEEBBB5FF58302F188199FE14A7211E3359954DB91

Function 00843E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00843EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00844002

Part of subcall function 0084ABC5: _Yarn.LIBCPMT ref: 0084ABE5
Part of subcall function 0084ABC5: _Yarn.LIBCPMT ref: 0084AC09

Strings

bad locale name, xrefs: 00843F46

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name
API String ID: 2070049627-1405518554
Opcode ID: 51402e661627cf6c2acba344d89349efbdb4a4ac418ba44d1bfff0b78d2f2057
Instruction ID: 3971b17d0fdeeb8854d8bc23969670d760f301c24e8c22cb303058dfdea48b74
Opcode Fuzzy Hash: 51402e661627cf6c2acba344d89349efbdb4a4ac418ba44d1bfff0b78d2f2057
Instruction Fuzzy Hash: C0412BF1A007459BEB10DF69C805B57BAE8BF04714F044628E459DB781E7B9E518CBE2

Function 0085B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0085B475

Strings

csm, xrefs: 0085B497
csm, xrefs: 0085B508

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 1c98226b2c7b1e1cb62b9659c989555404e23128c199f227d01c7746c4f848ae
Instruction ID: 8ed4ed461676dc31d2948c028783ef7056efb5a9abc3f77a02eced55c16f65aa
Opcode Fuzzy Hash: 1c98226b2c7b1e1cb62b9659c989555404e23128c199f227d01c7746c4f848ae
Instruction Fuzzy Hash: 3B31FB75400219EBCF3A9F54CC448AE7B66FF28317B18465AFD44CA122D332DDA9DB82

Function 00431B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431B7E
VariantInit.OLEAUT32 ref: 00431B91

Strings

', xrefs: 00431BF5

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: Variant$ClearInit
String ID: '
API String ID: 2610073882-1997036262
Opcode ID: fab3b1cf923dda6bbcbf2a6a4eb990dd60da037dcb32e50500b31a9bbd0eefbd
Instruction ID: f0fd381d5fec39a528671603911bf2c23c3a6a58f5352b7c8f79a7ebfcd5fa1a
Opcode Fuzzy Hash: fab3b1cf923dda6bbcbf2a6a4eb990dd60da037dcb32e50500b31a9bbd0eefbd
Instruction Fuzzy Hash: 8841C53400C7C19AD365DB38849879FBFE16BA3324F585A5DE5E50B2E2D3B68005C753

Function 0084B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0084B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0084B8DE

Part of subcall function 0085060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0084F354,00000000,?,?,?,0084F354,00843D4A,0087759C,00843D4A), ref: 0085066D

Part of subcall function 00858353: IsProcessorFeaturePresent.KERNEL32(00000017,0085378B,?,?,?,?,00000000,?,?,?,0084B5AC,0084B4E0,00000000,?,?,0084B4E0), ref: 0085836F

Strings

csm, xrefs: 0084B86D

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 4d02f9184a93abd97381575b8ede8adc00ecf01023ee589f8e58ed5a375bf190
Instruction ID: d4d0f6f604d992ed8e2ba966acf26d643022d82275504995e93b62fbf397e6b7
Opcode Fuzzy Hash: 4d02f9184a93abd97381575b8ede8adc00ecf01023ee589f8e58ed5a375bf190
Instruction Fuzzy Hash: F2215331E0021CEBCF24DF99D845AAEB7B9FF50750F180429E906EB251DB70ED458B82

Function 00431EB2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431EC8
VariantInit.OLEAUT32 ref: 00431EDB

Strings

', xrefs: 00431F3F

Memory Dump Source

Source File: 00000002.00000002.1782088667.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Crosshair-X.jbxd

Similarity

API ID: Variant$ClearInit
String ID: '
API String ID: 2610073882-1997036262
Opcode ID: 052859013d9d38e2667cd6d4a973d26e13259a8311236937566f347b4283eafd
Instruction ID: d243482addc6a9906db6340bbd49a0a88fe957b0ea19312892bb6b26dda998fa
Opcode Fuzzy Hash: 052859013d9d38e2667cd6d4a973d26e13259a8311236937566f347b4283eafd
Instruction Fuzzy Hash: 3431D43010C7C19AD366CB3C848878FBFE16B97624F581A9DF1E54B2E2D3668009C753

Function 0084B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00842673

Strings

ios_base::badbit set, xrefs: 00842650
bad array new length, xrefs: 00842626

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: fc27e4a6a10aee0947eca22240823dba798640370a2b16694ca6ba3baf0daca9
Instruction ID: 3a43a748f3257e0e3005032640890d31111127463681b1a3bd406ef20a3bd189
Opcode Fuzzy Hash: fc27e4a6a10aee0947eca22240823dba798640370a2b16694ca6ba3baf0daca9
Instruction Fuzzy Hash: B2019EF1604304ABDB049F28D855A1A7BE4FB18318F11881CF559CB301D375E808CB82

Function 00842610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0084F354,00000000,?,?,?,0084F354,00843D4A,0087759C,00843D4A), ref: 0085066D

___std_exception_copy.LIBVCRUNTIME ref: 00842673

Strings

ios_base::badbit set, xrefs: 00842650
bad array new length, xrefs: 00842626

Memory Dump Source

Source File: 00000002.00000002.1782153497.0000000000841000.00000020.00000001.01000000.00000003.sdmp, Offset: 00840000, based on PE: true

Associated: 00000002.00000002.1782140377.0000000000840000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782175566.000000000086D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782190382.000000000087A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782203878.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782216386.0000000000882000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1782243324.00000000008CF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_840000_Crosshair-X.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: 5184c4caf2ad40d7666167fc9f98797256676602d4bca5216ecbaf66da611765
Instruction ID: 4f54ca43b7d51de82d174464fec8d91e38ac6bf0e3ae3c626541bca1613f010f
Opcode Fuzzy Hash: 5184c4caf2ad40d7666167fc9f98797256676602d4bca5216ecbaf66da611765
Instruction Fuzzy Hash: 14F0D4F1A14300ABD700AF58D849747BAE4FB59719F12881CFA98DB300D3B5D458CB92

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Crosshair-X.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
Crosshair-X.exe

Function 0087A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00841FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Function 008424B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Function 0085CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00841750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Function 00855349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 008554EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Function 0085565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00863BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 008643CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 008490F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Function 0085DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00841EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON