xoilac-tv.online_new.exe

Code entropy is 7.5 or lower 0x2080–0x2200

0x20800070282d00000a0b077e1b000004284b.p(-.....~....(K
0x209000000a00077e1c000004282000000a00.....~....( ....
0x20a0007e1d00000413041613052b1b110411.~.........+....
0x20b005940c000815fe0116fe010d092d022b.............-.+
0x20c01300110517581305110511048e69fe04.....X.......i..
0x20d00d092dd907283200000a0000de052600..-..(2.......&.
0x20e000de0000002a00000110000000007b00.....*........{.
0x20f067e20005010000011e02282600000a2ag.........(&...*
0x210042534a4201000100000000000c000000BSJB............
0x211076342e302e3330333139000000000500v4.0.30319......
0x21206c00000034100000237e0000a0100000l...4...#~......
0x21306013000023537472696e677300000000`...#Strings....
0x214000240000181100002355530018350000.$......#US..5..
0x215010000000234755494400000028350000....#GUID...(5..
0x21606405000023426c6f6200000000000000d...#Blob.......
0x217002000001579fa2350902000000fa2533....W..5......%3
0x21800016000001000000510000000d000000........Q.......
0x219027000000470000004a00000004000000'...G...J.......
0x21a09e0000000e0000001b00000001000000................
0x21b015000000050000000500000005000000................
0x21c005000000180000000100000001000000................
0x21d0050000000400000000000a0001000000................
0x21e000000600b200ab000600b900ab000600................
0x21f05101450106001702ab0006002402ab00Q.E.........$...
0x220006004a03                        ..J.            

VirtualAllocEx API string reference 0x3202–0x34f2

0x32026f630057656263616d4d6f64756c6500oc.WebcamModule.
0x32124d6963726f70686f6e654d6f64756c65MicrophoneModule
0x32220050617373776f72645265636f766572.PasswordRecover
0x3232794d6f64756c650050726f6772616d00yModule.Program.
0x32426d73636f726c69620053797374656d00mscorlib.System.
0x32524f626a656374004d756c746963617374Object.Multicast
0x326244656c65676174650043325f504f5254Delegate.C2_PORT
0x327200524556455253455f5348454c4c5f50.REVERSE_SHELL_P
0x32824f52540043325f444f4d41494e00584fORT.C2_DOMAIN.XO
0x3292525f4b4559002e6363746f7200476574R_KEY..cctor.Get
0x32a2586f724b6579006765745f4e616d6500XorKey.get_Name.
0x32b25374617274004e616d650057485f4b45Start.Name.WH_KE
0x32c259424f4152445f4c4c00574d5f4b4559YBOARD_LL.WM_KEY
0x32d2444f574e005f70726f63005f686f6f6bDOWN._proc._hook
0x32e249440053797374656d2e546578740053ID.System.Text.S
0x32f27472696e674275696c646572005f6275tringBuilder._bu
0x330266666572005f61637469766557696e64ffer._activeWind
0x33126f77005f6c6f636b0053657457696e64ow._lock.SetWind
0x33226f7773486f6f6b457800556e686f6f6bowsHookEx.Unhook
0x333257696e646f7773486f6f6b4578004361WindowsHookEx.Ca
0x33426c6c4e657874486f6f6b457800476574llNextHookEx.Get
0x33524d6f64756c6548616e646c6500476574ModuleHandle.Get
0x3362466f726567726f756e6457696e646f77ForegroundWindow
0x33720047657457696e646f77546578740055.GetWindowText.U
0x3382706461746541637469766557696e646fpdateActiveWindo
0x33927700486f6f6b43616c6c6261636b0053w.HookCallback.S
0x33a2656e644c6f6f70002e63746f7200496eendLoop..ctor.In
0x33b2766f6b6500494173796e63526573756cvoke.IAsyncResul
0x33c274004173796e6343616c6c6261636b00t.AsyncCallback.
0x33d2426567696e496e766f6b6500456e6449BeginInvoke.EndI
0x33e26e766f6b6500574d5f4341505f445249nvoke.WM_CAP_DRI
0x33f25645525f434f4e4e45435400574d5f43VER_CONNECT.WM_C
0x340241505f53415645444942006361704372AP_SAVEDIB.capCr
0x3412656174654361707475726557696e646feateCaptureWindo
0x342277410053656e644d6573736167650044wA.SendMessage.D
0x3432657374726f7957696e646f7700776176estroyWindow.wav
0x344265496e4765744e756d44657673005052eInGetNumDevs.PR
0x34524f434553535f4352454154455f544852OCESS_CREATE_THR
0x34624541440050524f434553535f51554552EAD.PROCESS_QUER
0x3472595f494e464f524d4154494f4e005052Y_INFORMATION.PR
0x34824f434553535f564d5f4f504552415449OCESS_VM_OPERATI
0x34924f4e0050524f434553535f564d5f5752ON.PROCESS_VM_WR
0x34a24954450050524f434553535f564d5f52ITE.PROCESS_VM_R
0x34b2454144004d454d5f434f4d4d4954004dEAD.MEM_COMMIT.M
0x34c2454d5f5245534552564500504147455fEM_RESERVE.PAGE_
0x34d2455845435554455f5245414457524954EXECUTE_READWRIT
0x34e245004d555445580052616e646f6d005fE.MUTEX.Random._
0x34f2726e640053686f7757696e646f770047rnd.ShowWindow.G

Keylog record label for network transport 0x4367–0x4657

0x436754657874577269746572005772697465TextWriter.Write
0x43774c696e6500526561644c696e65006765Line.ReadLine.ge
0x4387745f5374616e64617264496e70757400t_StandardInput.
0x439753797374656d2e4e65742e536f636b65System.Net.Socke
0x43a7747300546370436c69656e74004e6574ts.TcpClient.Net
0x43b7776f726b53747265616d004765745374workStream.GetSt
0x43c77265616d007365745f4175746f466c75ream.set_AutoFlu
0x43d77368007365745f526564697265637453sh.set_RedirectS
0x43e774616e64617264496e70757400436c6ftandardInput.Clo
0x43f77365003c5374617274436f6d6d616e64se.<StartCommand
0x44074578656375746f723e625f5f31300043Executor>b__10.C
0x441753243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x44276e796d6f75734d6574686f6444656c65nymousMethodDele
0x44376761746531310053797374656d2e4e65gate11.System.Ne
0x444774005765625265717565737400437265t.WebRequest.Cre
0x445761746500487474705765625265717565ate.HttpWebReque
0x44677374007365745f4d6574686f64007365st.set_Method.se
0x4477745f54696d656f757400576562526573t_Timeout.WebRes
0x4487706f6e736500476574526573706f6e73ponse.GetRespons
0x4497650048747470576562526573706f6e73e.HttpWebRespons
0x44a76500476574526573706f6e7365537472e.GetResponseStr
0x44b765616d00537461727473576974680053eam.StartsWith.S
0x44c77562737472696e670055726900457363ubstring.Uri.Esc
0x44d761706544617461537472696e67007365apeDataString.se
0x44e7745f557365724167656e74006765745ft_UserAgent.get_
0x44f74e65774c696e650000002f6800740074NewLine.../h.t.t
0x45070070003a002f002f0078006f0069006c.p.:././.x.o.i.l
0x451700610063002d00740076002e006f006e.a.c.-.t.v...o.n
0x4527006c0069006e00650001134b00650079.l.i.n.e...K.e.y
0x4537006c006f00670067006500720000175b.l.o.g.g.e.r...[
0x454700480048003a006d006d003a00730073.H.H.:.m.m.:.s.s
0x4557005d002000000720003a00200000050d.]. ... .:. ....
0x4567000a00004f43003a005c00500072006f....OC.:.\.P.r.o
0x4577006700720061006d0044006100740061.g.r.a.m.D.a.t.a
0x4587005c00570069006e0064006f00770073.\.W.i.n.d.o.w.s
0x4597005500700064006100740065005c006b.U.p.d.a.t.e.\.k
0x45a700650079006c006f0067002e00740078.e.y.l.o.g...t.x
0x45b7007400000f4b00450059004c004f0047.t...K.E.Y.L.O.G
0x45c7003a000001000d570065006200630061.:.....W.e.b.c.a
0x45d7006d00000f770065006200630061006d.m...w.e.b.c.a.m
0x45e7005f0000092e0062006d007000000f57._.....b.m.p...W
0x45f70045004200430041004d003a0000154d.E.B.C.A.M.:...M
0x4607006900630072006f00700068006f006e.i.c.r.o.p.h.o.n
0x461700650000096d00690063005f0000092e.e...m.i.c._....
0x462700770061007600001d70006f00770065.w.a.v...p.o.w.e
0x46370072007300680065006c006c002e0065.r.s.h.e.l.l...e
0x4647007800650000819d2d0043006f006d00.x.e....-.C.o.m.
0x46576d0061006e0064002000220041006400m.a.n.d. .".A.d.

ms-settings Shell Open command key 0x4d44–0x5034

0x4d446100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x4d5443006f0072006500000f560065007200C.o.r.e...V.e.r.
0x4d64730069006f006e00000b31002e003200s.i.o.n...1...2.
0x4d742e003000001749006e00730074006100..0...I.n.s.t.a.
0x4d846c006c00440061007400650000117300l.l.D.a.t.e...s.
0x4d94630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x4da42f006300720065006100740065002000/.c.r.e.a.t.e. .
0x4db42f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x4dc472006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x4dd46e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x4de4610074006500220020002f0074007200a.t.e.". ./.t.r.
0x4df4200022000021220020002f0073006300 ."..!". ./.s.c.
0x4e0420006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x4e1420002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x4e2445004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x4e346e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x4e446c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x4e54740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x4e64730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x4e746100670065007200001742006f006f00a.g.e.r...B.o.o.
0x4e8474004500780065006300750074006500t.E.x.e.c.u.t.e.
0x4e9400030a00001363006d00730074007000......c.m.s.t.p.
0x4ea42e0065007800650000092f0061007500..e.x.e.../.a.u.
0x4eb4200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x4ec4770072002e0065007800650000808348w.r...e.x.e....H
0x4ed4004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x4ee40045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x4ef4005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x4f040065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x4f140073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x4f2400740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x4f340065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x4f44005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x4f5400011f440065006c0065006700610074...D.e.l.e.g.a.t
0x4f6400650045007800650063007500740065.e.E.x.e.c.u.t.e
0x4f7400001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x4f8400650072002e0065007800650000813d.e.r...e.x.e...=
0x4f942d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x4fa4200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x4fb450007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x4fc46300650020002d004400690073006100c.e. .-.D.i.s.a.
0x4fd462006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x4fe469006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x4ff46f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x50047200750065003b002000530065007400r.u.e.;. .S.e.t.
0x50142d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x5024720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x503469007300610062006c00650049004f00i.s.a.b.l.e.I.O.

Microsoft company version identity 0x5d62–0x5f62

⋯6 more rows
0x5dc2630061006c0020005500700064006100c.a.l. .U.p.d.a.
0x5dd27400650000004c001600010043006f00t.e...L.....C.o.
0x5de26d00700061006e0079004e0061006d00m.p.a.n.y.N.a.m.
0x5df26500000000004d006900630072006f00e.....M.i.c.r.o.
0x5e0273006f0066007400200043006f007200s.o.f.t. .C.o.r.
0x5e1270006f0072006100740069006f006e00p.o.r.a.t.i.o.n.
0x5e2200006c0021000100460069006c006500..l.!...F.i.l.e.
0x5e3244006500730063007200690070007400D.e.s.c.r.i.p.t.
0x5e4269006f006e00000000004d0069006300i.o.n.....M.i.c.
⋯3 more rows
0x5e8272007600690063006500000000004000r.v.i.c.e.....@.
0x5e9210000100460069006c00650056006500....F.i.l.e.V.e.
0x5ea27200730069006f006e00000000003100r.s.i.o.n.....1.
0x5eb230002e0030002e0031003900300034000...0...1.9.0.4.
0x5ec231002e003100320030003200000054001...1.2.0.2...T.
0x5ed21900010049006e007400650072006e00....I.n.t.e.r.n.
0x5ee261006c004e0061006d00650000007800a.l.N.a.m.e...x.
⋯8 more rows

Evidence