Edit tour

Windows Analysis Report
phantomtoolsv2.exe

Overview

General Information

Sample name:	phantomtoolsv2.exe
Analysis ID:	1532357
MD5:	0c01cfc0685211b3c655c7a9526f1849
SHA1:	864d23804b6e3c98efd1b56863a484b505ddf40b
SHA256:	8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Creates files in alternative data streams (ADS)

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

Self deletion via cmd or bat file

Sigma detected: Suspicious Ping/Del Command Combination

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

phantomtoolsv2.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\phantomtoolsv2.exe" MD5: 0C01CFC0685211B3C655C7A9526F1849)

phantomtoolsv2.exe (PID: 7360 cmdline: "C:\Users\user\Desktop\phantomtoolsv2.exe" MD5: 0C01CFC0685211B3C655C7A9526F1849)

cmd.exe (PID: 7636 cmdline: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7680 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "79.137.202.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Legenda", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 1048576}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: phantomtoolsv2.exe PID: 7360	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: phantomtoolsv2.exe PID: 7360	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Ping/Del Command Combination

Source: Process started

Author: Ilya Krestinichev: Data: Command: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe", CommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\phantomtoolsv2.exe", ParentImage: C:\Users\user\Desktop\phantomtoolsv2.exe, ParentProcessId: 7360, ParentProcessName: phantomtoolsv2.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe", ProcessId: 7636, ProcessName: cmd.exe

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:38:09.966420+0200	2049441	1	A Network Trojan was detected	192.168.2.4	49737	79.137.202.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:38:09.966420+0200	2050806	1	A Network Trojan was detected	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.971752+0200	2050806	1	A Network Trojan was detected	192.168.2.4	49737	79.137.202.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:38:09.966420+0200	2050807	1	A Network Trojan was detected	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.971752+0200	2050807	1	A Network Trojan was detected	192.168.2.4	49737	79.137.202.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Avira: detection malicious, Label: HEUR/AGEN.1354117

Found malware configuration

Source: 1.2.phantomtoolsv2.exe.140000000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "79.137.202.152", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "Legenda", "self_destruct": true, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 1048576}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006FB80 CryptUnprotectData,LocalFree,	1_2_000000014006FB80
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400D0090 CryptUnprotectData,	1_2_00000001400D0090
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140035E00 CryptUnprotectData,LocalFree,	1_2_0000000140035E00
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006FEA0 CryptProtectData,LocalFree,	1_2_000000014006FEA0

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: phantomtoolsv2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B6740 FindClose,FindFirstFileExW,GetLastError,		1_2_00000001400B6740
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B67F0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		1_2_00000001400B67F0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007EF60 GetLogicalDriveStringsW,

1_2_000000014007EF60

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 4x nop then push rdi	0_2_00007FF7B890C950
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 4x nop then sub rsp, 28h	0_2_00007FF7B890C460
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 4x nop then push rdi	1_2_00007FF7B890C950
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 4x nop then sub rsp, 28h	1_2_00007FF7B890C460

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49737 -> 79.137.202.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49737 -> 79.137.202.152:15666
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49737 -> 79.137.202.152:15666

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 79.137.202.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 79.137.202.152 79.137.202.152
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: PSKSET-ASRU PSKSET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.202.152

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007C5E0 recv,recv,closesocket,WSACleanup,

1_2_000000014007C5E0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: phantomtoolsv2.exe, 00000001.00000003.1895778572.00000210210C0000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1895814243.00000210210C4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1725699673.00000210210B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: phantomtoolsv2.exe, 00000001.00000003.1896383235.000002101E9B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021351000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743933809.0000021021352000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021351000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743933809.0000021021352000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: phantomtoolsv2.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021295000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1738488858.00000210215FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207DB000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020708000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021461000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207D3000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.000002102075C000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020754000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021469000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020700000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021209000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212D4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732301721.0000021021293000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021453000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732566332.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021324000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212D4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732301721.0000021021293000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021453000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732566332.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021324000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021295000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1738488858.00000210215FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207DB000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020708000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021461000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207D3000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.000002102075C000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020754000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021469000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020700000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021209000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021211000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: phantomtoolsv2.exe, 00000001.00000003.1738112892.00000210214D5000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207E3000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.000002102070F000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021219000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: phantomtoolsv2.exe, 00000001.00000003.1738112892.00000210214D5000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207E3000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.000002102070F000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021219000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007D6E0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_000000014007D6E0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88046A4 CreateToolhelp32Snapshot,Process32First,Process32Next,NtClose,	0_2_00007FF7B88046A4
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8803060 GetCurrentProcess,NtQueryInformationProcess,GetTempPathA,strlen,strlen,memcpy,	0_2_00007FF7B8803060
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8803C70 GetCurrentProcess,NtQueryInformationProcess,GetTempPathW,wcslen,wcslen,strlen,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wcslen,LdrLoadDll,GetProcAddress,VirtualProtect,LdrUnloadDll,	0_2_00007FF7B8803C70
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140082030 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	1_2_0000000140082030
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400D06E8 NtAllocateVirtualMemory,	1_2_00000001400D06E8
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400818F0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtDuplicateObject,GetCurrentProcess,NtDuplicateObject,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	1_2_00000001400818F0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88034D0	0_2_00007FF7B88034D0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8803C70	0_2_00007FF7B8803C70
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88FC950	0_2_00007FF7B88FC950
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8825140	0_2_00007FF7B8825140
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88E7220	0_2_00007FF7B88E7220
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8806A40	0_2_00007FF7B8806A40
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88034D0	0_2_00007FF7B88034D0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8807290	0_2_00007FF7B8807290
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B881DA84	0_2_00007FF7B881DA84
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8815B20	0_2_00007FF7B8815B20
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B881D367	0_2_00007FF7B881D367
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B881C4A0	0_2_00007FF7B881C4A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88264F0	0_2_00007FF7B88264F0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014005F140	1_2_000000014005F140
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400421C0	1_2_00000001400421C0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007F210	1_2_000000014007F210
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014008426B	1_2_000000014008426B
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400743A0	1_2_00000001400743A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007E3D0	1_2_000000014007E3D0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014002F650	1_2_000000014002F650
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140086680	1_2_0000000140086680
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007D6E0	1_2_000000014007D6E0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014003B740	1_2_000000014003B740
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014003C7E0	1_2_000000014003C7E0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B67F0	1_2_00000001400B67F0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140076BA0	1_2_0000000140076BA0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007FBA0	1_2_000000014007FBA0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014003ABE0	1_2_000000014003ABE0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009ACF0	1_2_000000014009ACF0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140084CF0	1_2_0000000140084CF0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007CDF0	1_2_000000014007CDF0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014003CE80	1_2_000000014003CE80
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014002EF60	1_2_000000014002EF60
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009DFA0	1_2_000000014009DFA0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006E000	1_2_000000014006E000
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014004E000	1_2_000000014004E000
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140082030	1_2_0000000140082030
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140036050	1_2_0000000140036050
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006B0A0	1_2_000000014006B0A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140092094	1_2_0000000140092094
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014007E0B0	1_2_000000014007E0B0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400300C6	1_2_00000001400300C6
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006A100	1_2_000000014006A100
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014003A110	1_2_000000014003A110
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140006180	1_2_0000000140006180
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140028200	1_2_0000000140028200
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009E21C	1_2_000000014009E21C
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009227C	1_2_000000014009227C
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B92E0	1_2_00000001400B92E0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400532E0	1_2_00000001400532E0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140096300	1_2_0000000140096300
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140056340	1_2_0000000140056340
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140026340	1_2_0000000140026340
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140093344	1_2_0000000140093344
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140025350	1_2_0000000140025350
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140055360	1_2_0000000140055360
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140082380	1_2_0000000140082380
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006A400	1_2_000000014006A400
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400A5464	1_2_00000001400A5464
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140092464	1_2_0000000140092464
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009C498	1_2_000000014009C498
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006E49A	1_2_000000014006E49A
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014004C500	1_2_000000014004C500
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140062510	1_2_0000000140062510
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400705A0	1_2_00000001400705A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140006610	1_2_0000000140006610
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400596B0	1_2_00000001400596B0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006A730	1_2_000000014006A730
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140066750	1_2_0000000140066750
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400907A0	1_2_00000001400907A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009E7A4	1_2_000000014009E7A4
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009B968	1_2_000000014009B968
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400269E0	1_2_00000001400269E0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140078A40	1_2_0000000140078A40
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006AA50	1_2_000000014006AA50
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140092AAC	1_2_0000000140092AAC
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140037AAD	1_2_0000000140037AAD
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400A6ACC	1_2_00000001400A6ACC
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400BBB80	1_2_00000001400BBB80
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006DBC0	1_2_000000014006DBC0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014002FC80	1_2_000000014002FC80
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140006D20	1_2_0000000140006D20
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014004AD30	1_2_000000014004AD30
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006AD70	1_2_000000014006AD70
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140005DB0	1_2_0000000140005DB0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009BE18	1_2_000000014009BE18
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014006CE40	1_2_000000014006CE40
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140075E70	1_2_0000000140075E70
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140072EC0	1_2_0000000140072EC0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014009CF18	1_2_000000014009CF18
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_0000000140038FB0	1_2_0000000140038FB0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B88FC950	1_2_00007FF7B88FC950
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B8806A40	1_2_00007FF7B8806A40
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B881DA84	1_2_00007FF7B881DA84
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B8815B20	1_2_00007FF7B8815B20
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B8803C70	1_2_00007FF7B8803C70
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B8825140	1_2_00007FF7B8825140
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B88E7220	1_2_00007FF7B88E7220
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B8807290	1_2_00007FF7B8807290
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B881D367	1_2_00007FF7B881D367
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B881C4A0	1_2_00007FF7B881C4A0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B88034D0	1_2_00007FF7B88034D0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B88264F0	1_2_00007FF7B88264F0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: String function: 00007FF7B8902CD0 appears 32 times
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: String function: 0000000140034B20 appears 41 times
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: String function: 00000001400300A0 appears 58 times
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: String function: 00007FF7B890C0A0 appears 43 times

Source: phantomtoolsv2.exe_a.dll.0.dr

Static PE information: Number of sections : 11 > 10

Source: phantomtoolsv2.exe, 00000001.00000003.1895939117.0000021021451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs phantomtoolsv2.exe
Source: phantomtoolsv2.exe, 00000001.00000003.1884710900.000002102144D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs phantomtoolsv2.exe
Source: phantomtoolsv2.exe, 00000001.00000003.1894702858.000002102144D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs phantomtoolsv2.exe
Source: phantomtoolsv2.exe, 00000001.00000002.1898356987.0000021021451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs phantomtoolsv2.exe

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/2@1/2

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400835B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		1_2_00000001400835B0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400D0008 AdjustTokenPrivileges,CredEnumerateA,		1_2_00000001400D0008

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 0_2_00007FF7B88046A4 CreateToolhelp32Snapshot,Process32First,Process32Next,NtClose,

0_2_00007FF7B88046A4

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_00000001400D0730 CoCreateInstance,

1_2_00000001400D0730

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

File created: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963A85413CE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03

Source: phantomtoolsv2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\phantomtoolsv2.exe "C:\Users\user\Desktop\phantomtoolsv2.exe"
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Users\user\Desktop\phantomtoolsv2.exe "C:\Users\user\Desktop\phantomtoolsv2.exe"
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Users\user\Desktop\phantomtoolsv2.exe "C:\Users\user\Desktop\phantomtoolsv2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: phantomtoolsv2.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: phantomtoolsv2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: phantomtoolsv2.exe

Static file information: File size 2746880 > 1048576

Source: phantomtoolsv2.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x10bc00
Source: phantomtoolsv2.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x16f600

Source: phantomtoolsv2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 0_2_00007FF7B8803C70 GetCurrentProcess,NtQueryInformationProcess,GetTempPathW,wcslen,wcslen,strlen,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wcslen,LdrLoadDll,GetProcAddress,VirtualProtect,LdrUnloadDll,

0_2_00007FF7B8803C70

Source: phantomtoolsv2.exe	Static PE information: section name: .xdata
Source: phantomtoolsv2.exe_a.dll.0.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B881AAF6 push rsp; retf	0_2_00007FF7B881AAF9
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B881D857 push rax; iretd	0_2_00007FF7B881D858
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B881AAF6 push rsp; retf	1_2_00007FF7B881AAF9
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B881D857 push rax; iretd	1_2_00007FF7B881D858

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

File created: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Jump to dropped file

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_00000001400740C0 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

1_2_00000001400740C0

Hooking and other Techniques for Hiding and Protection

Creates files in alternative data streams (ADS)

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

File created: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Jump to behavior

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"			Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000			Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Dropped PE file which has not been started: C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Jump to dropped file

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-14088

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-71649

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

API coverage: 7.7 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B6740 FindClose,FindFirstFileExW,GetLastError,		1_2_00000001400B6740
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400B67F0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		1_2_00000001400B67F0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007EF60 GetLogicalDriveStringsW,

1_2_000000014007EF60

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_0000000140094A30 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

1_2_0000000140094A30

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: phantomtoolsv2.exe, 00000001.00000003.1882946764.0000021021351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: phantomtoolsv2.exe, 00000001.00000003.1726312341.000002101EA10000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000002.1897542352.000002101E9FA000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1896285771.000002101E9FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWcP;0
Source: phantomtoolsv2.exe, 00000001.00000002.1897542352.000002101E9C0000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1896285771.000002101E9BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: phantomtoolsv2.exe, 00000001.00000003.1726312341.000002101EA10000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000002.1897542352.000002101E9FA000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1896285771.000002101E9FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	API call chain: ExitProcess graph end node			graph_1-71598
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	API call chain: ExitProcess graph end node			graph_1-71603

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

0_2_00007FF7B8803C70

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_00000001400D02C8 IsDebuggerPresent,

1_2_00000001400D02C8

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_00000001400B8A44 GetLastError,IsDebuggerPresent,OutputDebugStringW,

1_2_00000001400B8A44

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

0_2_00007FF7B8803C70

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B88011D9 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,	0_2_00007FF7B88011D9
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 0_2_00007FF7B8AA0550 SetUnhandledExceptionFilter,	0_2_00007FF7B8AA0550
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00000001400D02D8 SetUnhandledExceptionFilter,	1_2_00000001400D02D8
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_000000014008D3D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_000000014008D3D8
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: 1_2_00007FF7B88011D9 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,	1_2_00007FF7B88011D9

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	NtQueryInformationProcess: Indirect: 0x7FF7B8803CAD	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	NtQueryInformationProcess: Indirect: 0x7FF7B8803098	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	NtClose: Indirect: 0x7FF7B8804830

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Memory written: C:\Users\user\Desktop\phantomtoolsv2.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Thread register set: target process: 7360

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_0000000140072EC0 ShellExecuteW,

1_2_0000000140072EC0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Users\user\Desktop\phantomtoolsv2.exe "C:\Users\user\Desktop\phantomtoolsv2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 1.1.1.1 -n 1 -w 3000	Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 0_2_00007FF7B8804350 cpuid

0_2_00007FF7B8804350

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A409C
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: EnumSystemLocalesW,	1_2_00000001400A416C
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: EnumSystemLocalesW,	1_2_0000000140099354
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: GetLocaleInfoW,	1_2_00000001400D0390
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: GetLocaleInfoEx,FormatMessageA,	1_2_00000001400B63B0
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_00000001400A45A8
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_00000001400A4784
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: GetLocaleInfoW,	1_2_0000000140099898
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	1_2_00000001400A3D50

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 0_2_00007FF7B881B500 GetSystemTimeAsFileTime,

0_2_00007FF7B881B500

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007DCC0 GetUserNameW,

1_2_000000014007DCC0

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Code function: 1_2_000000014007F210 GetTimeZoneInformation,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,

1_2_000000014007F210

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: phantomtoolsv2.exe PID: 7360, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: phantomtoolsv2.exe PID: 7360, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: phantomtoolsv2.exe, 00000001.00000002.1897429096.000002101E999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: phantomtoolsv2.exe, 00000001.00000002.1897429096.000002101E999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: phantomtoolsv2.exe, 00000001.00000003.1758154668.0000021023AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "software": "Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K",
Source: phantomtoolsv2.exe, 00000001.00000002.1897429096.000002101E999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: phantomtoolsv2.exe, 00000001.00000002.1897429096.000002101E999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: phantomtoolsv2.exe, 00000001.00000002.1897429096.000002101E999000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\phantomtoolsv2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\phantomtoolsv2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: phantomtoolsv2.exe PID: 7360, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: phantomtoolsv2.exe PID: 7360, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Abuse Elevation Control Mechanism	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	3 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Access Token Manipulation	1 DLL Side-Loading	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	211 Process Injection	1 File Deletion	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 NTFS File Attributes	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll	100%	Avira	HEUR/AGEN.1354117
C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://gcc.gnu.org/bugs/):	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gcc.gnu.org/bugs/):	phantomtoolsv2.exe	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021351000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743933809.0000021021352000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212D4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732301721.0000021021293000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021453000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732566332.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021324000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743029885.0000021021351000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743933809.0000021021352000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021295000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1738488858.00000210215FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207DB000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020708000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021461000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.00000210207D3000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.000002102075C000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020754000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742843881.0000021021469000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020700000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021209000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1742408396.0000021021211000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021348000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212D4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732301721.0000021021293000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212FE000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021453000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1732566332.0000021021440000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021324000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1730304595.00000210212E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	phantomtoolsv2.exe, 00000001.00000003.1730304595.0000021021348000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.microsoft.t/Regi	phantomtoolsv2.exe, 00000001.00000003.1895778572.00000210210C0000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1895814243.00000210210C4000.00000004.00000020.00020000.00000000.sdmp, phantomtoolsv2.exe, 00000001.00000003.1725699673.00000210210B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	phantomtoolsv2.exe, 00000001.00000003.1737482716.0000021020764000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	phantomtoolsv2.exe, 00000001.00000003.1743619937.0000021021441000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.137.202.152	unknown	Russian Federation		42569	PSKSET-ASRU	true
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532357
Start date and time:	2024-10-13 01:37:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	phantomtoolsv2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 73 Number of non-executed functions: 161
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: phantomtoolsv2.exe

Simulations

Behavior and APIs

Time	Type	Description
19:38:03	API Interceptor	2x Sleep call for process: phantomtoolsv2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
79.137.202.152	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HS034Ewroq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	setup_installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	WarzoneCheat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
104.26.13.205	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.74.152
	ATLANTIC STAR - VESSEL DETAILS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	024.xlsx.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Order0958490.vbe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	https://www.canva.com/design/DAGTGtfEYnw/CziuYyD8EEWyTr61OD4BbQ/edit?utm_content=DAGTGtfEYnw&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutto	Get hash	malicious	HtmlDropper	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AAAjUdfNc16+VqCOWdjhu7TjhebDwXm6ITDaAzM2/RBqTCouOd4syZWt0oQeHch0J32d09qewtBep0xMzEqQw5uCDD5jzGMptv2Ml8tKG/C8CtlmUW+BwgihXDjkVb9+HrdQMTDnH/ltKCqbqkeSWCTVbTbsi7hQm50lkSO+uIKP+WaZVK5CwB+KNw5vz0h1+VWB9nXYS7r/65KwDXG1eoQ7LpgExf5uqFhJOeKU2lxyf8MZFWma+Jpcd8qAgpI5cl3w3zd+Vm0EYEfvHWX+4U6+p25bR3xOeQgBPB06jegeQ9cdnaCwg3Jra3NPSUfO/ZRQe9TJEW4VVwilXp7v0mwUyqJcK2y5kBNWNZEBnnQaAV+iawzJY19HetwEfzVabFBg3HhgYGx7XFWZYjHTHjwVWsbkjfgBb5461v0CHJjM9jrxfdj1kWIpcxid8O+dUSurKUOY4Hbb6SKXakBTmnkrYs0n3Xg5Ig==&c=AABu3sW2q3Ir8ifQJAijAhNJKq0uXwwF4aGWbgefQqJepVeNmQ2aDLrgth/4e3uZIWGGIQ8D3UPNbSnpgolkZPjCVjLlF8o96RZE6aKBP9hbbWDin7ntLRUM+OO5f3pIO2jZnmZof+ubVBUQEbWFAbo8xkwwPjD2yomWYO9BLauUbPdhe7sTeQubBshJfuD8IakpYR9mWvaRkj7jNE3uduhHnJqo59l67j+0INR7XdqioPPPYIlYt8Y2ErrD/Hm1x7Ub0JlpSy2dIylu82OHsbPe2IgE0AfUZGQlqmZjkJjdk/1R+5UTAbpM4Ru2nPA1W7k8m3b56CPQfp4Nfu7t5KTvxCSLpsyTXBp2H+CLMJgrqBWvScKuAGZzoBftoxN6AlJm7/tBk90HG/fSCigf6L5/vrhdqLwDnA3umOCSZNa6Rd/lq2DBocN9C5i+TM7dwQouAP+UKgVQf4ATMh19VLexy/mmb76HgGZt4HtVGufMb6cC2I7sVZK9dBduwlRzxT47SRfRKthnR5h3xirvQPbRJwRGy1YOGI3PBe6L8zkZnlHm4NWF1riKc7NfDV2jKR/ux1g+p2dIOZSC6QRSQfNi2L0zb9mMJvmZGJpdRbwk09T/RgLB6/6oigEcyMOmQDpPT8ma	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AACrcmbDni/ExL+6O84qnOq7s+7FEV7f2cEnFZCBGkVuVLwxJJ9kIF+/XsJvnT/ZZCSNu0ZPkHJMldgNU5hySzD4vbkLFmicZpeb27RRNiBBqzluO2njDgWrhNVOuuG5KecX01qr4Wu4+GPJbk1wcH4NmoDfnECMgEyVdYVJNd9SJ/Z6oeOmLYfmhHtJEcZB1zTo2XcCZUK4o1X55Z6mDqHfXia9/zchVngkbUJFubdOeeGrUXmliV4kA4X0r42Yjp3RKfpMvJU0dvSKL9oGxXQi9sD/MbbP4pxgNW6CajbdZVfsCIontUHWT1eFW4HrQm9NkGaKTegqBxEs/bh3fwfINtkSa08UEhuWP97GhgCO8AMh0qPvYF1Rp7eiHGFkb8QogMMfuDrW2QnTqHRWnTzitTqkjecFMC67nh1FVX/+SWo05+3MmWfzaTxkwp1iAJoDUcmTFcR0WSTfeepWakTIU1exnjYHjHsm9FYU&c=AABJIKCyntddafHrxXwMffbew9PUcwQ56WCR8mvcT/7tDRFoJSRw3QNX02Q/MIVoixgn9dE9sMMP0GDnwqQ0LdLGXfvFaDm4lnRP0nKKMx/K5F9QxPOFroSM5e8+RBG+qqCfBnKxbWihL3/38edMaV7uTv7a0UGb2nVUF+n7XQAl2QSudEpYlV++l35LZxi6JWsnjixzdQpF+bXikFz1oYDN6GSuDb0op6aViO8V/0UhqnTHHddY9/cqyxhVsr874sBNA2avRHpdaXr1CP2PeHJcUgsGQb+Q5ZsuH9DAP++Oq7lFPe0lbuV3tYUIr/YAS6C7DT9Oee2yUkZYYTbI0bVJgmpWHa/G9q/wBFVVHuCTY5U3Rk5FsGRYQV6gWYrnX5DIQf3ZS3CM9xlUC2XMY8/htbCHQHuT5hjcDdzUTL+rWXnJ/TpkKPDyDGmCQh8idvsKAqOWIYWkO3X5LUWuEryoODEKawcYmYfc7zahLtlk7MGx3wWvCKqqkAg6bFwWWKWXURv3AGYvESLycicJVk8PxbBHrVkb/ZjVWsbKsit0CCZTx+7Bs7ZMtFKW5bo+GHe3oXwvXrlQS2IjtYPTG6q1fOR5753mseQVzhjXvKuOJkAQb03nyAw9hJo2vgadjjmOtgB9	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AADy6+7GSFDtie9t8Cg/YUEnWHeQNpQUM5LtDe7UJMsLOceAyoyG1gPOseIEt6wEQOIS0cQG9+43HQOpwin+IcDGpXOmivIAoIj+kjiIGL1D2+8BvnDBEaMAH0f591eHch8eVhYXQMKLzHwgDODg3wt5JqhlbP9RQzflWbxkgz8rcLW9fZi6fO8I2q/H/mufxAmprX0pckYJIlZDOjEWtANKm9qQyuOPBTmTxFfQ7lSnZTWTopfzM4iUzlHH6YHH2Gwf9rOJKxuawJshVk1D6tC4SPWT4Qn+EH36v6noVRG1OVZuyh8POMokxISZrUYw04m/WI9EIj5YnXnJ0pu3aN84TxZoMpQWLf/bmERiIc3Nyv1tTCdvcY5yUV048SjizDEvcSo7xAYIkZcbJD4FxApNB4P7tHx7BM4Ye85I4pWktamhPb27vCl/+uYQPRubCgSnJCgEpm957xU4Pe9/Mw441Bx0a9Cw1g==&c=AAAMLqZiPcHPCafs0rFGm1fIkoNaTXck7ODBjyaeBBJn4WJkh+1bSUuW3EZ3mxfwfU+bqGXZerIBh+MSgUxyjr2dBgbCYcsfxsvjUb8rm3+6Y+MBXQzywIZk3yyBwMGrGcyqAW4sC8CEsQLo0qa26hZf6P5Mds0gAcBhLOQHNHGs04Bz8kP6rN3oyHvKAVKj6q6jh+o5tCfFCSfoFphn1jIlhz58l/iThGupLjhturtvKm1NOX3hQvVyGuodJdqpVFaaDIitHXcYMqB9UmB9x5Je567LlrJzANu3yeDnFlF+FPlEJBxfqHj5MAKq9a5hjcUMFWRj2C1f6q3FTviqfxGBcXqL6mjrfRn2e6SZ3cLMdbrvJF8+K9bEjK0z+DPrn/wowMPNg/sWBhdBb591VOmiiOgz82MQYX1oZvuxWVx8Ss8Y39FUpF/cGTcZLojkZK6/ZSGPHVUwgwezuarqDmRh2tnVahKh1zxiH7oFrg0dqApoWgloHFVuYES+Zx6Fwu8ffg2y+FHXsyJlLjARsT0dR3inuufunKnxFU0f0p8osK+QnybUWCcqfkqTetWNzB5Z8asqQvYhVbUlxqje0VAbhML1S+q4B7u3yifa6/t82x0LbRE1kHeNSO2USFPZmw2CUqF5	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AACK/veH9NDjNFiJHV0SalQi1vBoTxR3+CaR+Tf08xqCc5VCUGXc4X3qdIj9jWGkdCLuES/KY7ELen4EAn/FdnHqCQjbGr4W7dR4kVnBVs6emUveso+FtMlz8WLaK/uswzzWIgI+d66EsmSIAjCn6klItun/LyfhMBm/RvF8+GmEHKuHrtJ8flo99oIsJ0uYTUcGFmrLFZUm12SmxPleHrWwUcLBo1d4hUAo1H1WkirRXbLvtA5AFdQBsGObYvK4Jtgjqj5gw5MW75B9OQ54AcZkBQKcIkmFcg1YL0qDKrf81oJq2UUhMNPl/V/7Lmh2Iy3+rO2Qx71WjGONpPizWLvD7lune8iRYENSNu1xGJst2AqunbtEprrHIRzSb0HY+HbbjV8np3yVIxGt0yN7Vmb5AARDME7dIwHUrmOBP8igeJjkCyNogIrPeE8U4hVHOONDQ0fRseICVU1/ok2ExphS1u92stTGUjMCSci5vEz5fgxKUh8PMHHlxtZQmBjhUQ==&c=AABwK74RGNbpZkLbXDMgwGkEPcjIolhPI3ARymI3akMXqIIsvKkft1xo30+FsOmyglvzbe8Yz6H3Z4LxZ/0aTZFTqxR6u54legvtFlkuV/Y5fZXwm/YmPanR9jUnqtc4hPznzAuUrT6U7sovDeUggzqrrdSH45Gj/uRY+/LazDIdhTbOxXQwN2GEeE643R7hV3n9WYZrcN1rJdKE4J3VridUK5YywIX20BWPmYGQ+iqSfiaJQlNujGzur2PRjzxDNGxHixYHr88wjhccRzzqt63TgH68hxiQWBS2WMJ8V78YgSedyDzugz0SWoHXC4lIoIg/mD4/gfyj8ItwLNrpe3LWbVMyaC3Ad4pEpAUwx2rMNAE2ZRJGw2pFtc10IGwr77FIEYyERoM+q4jxSJoFtK3knGK9ms7DQJFt8w0eTeON/BC9KGyQaC64dCNz+N4+Xs4aPX/XWl9TCa+jzc65pmbZE5Fi0IpF2S9gBcOFdJjQtmI1vA8o1jxGHT+6uixJoZsPaoFWVJAAyljwh/1U0kE7VmRRTmULBXD/WiUTWrHi0xFoOw6OPuSKQtWkN98CCafLvNNkYgEzgEh7ZP0U7YG2Ui/9zjmE3N9hxjTOSgO7rba70M6HBYbc4mR2U37DUGxUEU5C	Get hash	malicious	Unknown	Browse	23.227.38.65
	https://confortdelaine.net/_t/c/A1020005-17FC1B6DB5BD9241-7C90090F?l=AADxL8L+GAtO4/UVYp8MqA+Sj5TSCBAjVAdgXYZk0eblTNDmdbfgDu4l4W8iDoNzLFaNYKheJg76tFPqEuw8bYVS19fwe8hhswMobSAd4H/SzCs2QZVam2WjwmfTSoUPGcyvkpmuq0ISpqIb5vzyWcVKqNTTUTopXpL6xGs6pKvxOLPHunpbWiA5Gm+6TueYrrthSZbOadliaedCA22mM2wTV3gNe1fzC90aFBzTBaHWQxrEXzwRC6Xpb34McFMIrdgz9IrbVcDvXBernticMrVIP1TsiiLBaevE/CbzrdEvKiAf8B42dT0tqManmBttR7OtoRCGhXROd01v21If1UCdSvfYAAn1bVRGaJ9z2t8XAOV+QkM7Cqp/NYaWVJFyc+dA9aHG4frM5s9sjjMhd8DDJlA/xoh8DfH8PxQbhenIpHsjrxicNhJW50U6jm9b5vBU2fBUQmACYkRTG3EArpkHaCcm6XS9GA==&c=AAAYKEKcMSJ1NhQeweljhmaJ+T0baps+PAKT1EF6chohNYEP5R3N/C0hM2VhIOm2Tlt7H1sENRf12adWDrfBHT/6guQroYvA1xotjOsoTnpw56aO6JiaFKlDBMZtdU6YKZE3+4BogcMiYQDvUyAIZDGB062Whj/cCyQvRMUpY4wDddIiNr94Kgc6rYiywX8977La5/XVq66oa1ne7RDSJfRtlqqxgm7XClHOdI3OA0B3qp+/4vc9qgP5m9K6oiTuJ4l3/gwYk0AGIFk70mpjAiufUD44SD2hGTqQBZFJxcidB+zxqyjG/eVcsY6bMPspPna712CUEgXxQWyye0KuqXGZwYCsXaY+GFuBxowOIYKDk88Wtn356Ig9rNqxPX0CvkkgfotUXuPAX4wXqch6/QUpTLyadqx9C4Sc9kx1mpdTeUHzvi6Gp/gANpe6MvHTICJXAKMZKOGh4M+g4DVVhDl13yVrsEhLU2KeP1rJQoSuV0TN//J1ytC9xeA0zXi0gdvfANs0by84UFwBhR1PwHWsOwBbEmjwAuhtE0l27s++Cu1oMhZrefHgxts/MCdJtPjWL98LN1t6aP4/1kw0rhJwk2N1AghWHevFg3v4NeNiBDOA4oRqwpcCL3uBJXOIP2dfK01+	Get hash	malicious	Unknown	Browse	23.227.38.65
	http://servicesopm.com/login.php	Get hash	malicious	Unknown	Browse	188.114.96.3
PSKSET-ASRU	SecuriteInfo.com.Win64.PWSX-gen.30688.21076.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	HS034Ewroq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	Oldsetup.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	cpXiB8kFJ7.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	79.137.199.150
	Aannir04sD.exe	Get hash	malicious	Njrat	Browse	79.137.199.150
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	79.137.199.150
	gGcpYEOr8U.exe	Get hash	malicious	Unknown	Browse	79.137.199.150
	setup_installer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152
	WarzoneCheat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	79.137.202.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	104.26.13.205
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.26.13.205
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Synaptics.exe	Get hash	malicious	XRed	Browse	104.26.13.205
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	Produkttyper.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	P065.00760_0858_PDF.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205
	Agenda de Pagamento outubro 2024.vbe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.205

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

Download File

Process:	C:\Users\user\Desktop\phantomtoolsv2.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1430016
Entropy (8bit):	7.516273947536266
Encrypted:	false
SSDEEP:	24576:TjSpDfQz9pRxewMCvnv49hIScHVpwPczeWkL5yS6oMKH95T2FvVJsE0jou:TjS9fQzm/kv49hISc1HeW6YS3jLqFtJc
MD5:	BC690CC3A740F79F71732E6DBA60B67A
SHA1:	1B3B7107BDDDCEE5F10781F466A52F195190F342
SHA-256:	3FB6B027285DB00651F0257DF8F5CA9DB5665A24A5E23F476CD3E71244BFBC7F
SHA-512:	BD090037334592F7000BE3EC1FF3E77F4303F59F071A7FD6D21EEE6B96D07D8AAF6F51725369F2823DD9E0FE2BC1F437BC0FC32EE7AF2DE2ED49C0B654BF521A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g..........."...)............`..........`.............................@...........`... ..............................................................................0..............................@...(...................@................................text...............................`..`.data....[...0...\..................@....rdata...........0...v..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..............................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc.......0......................@..B........................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.825671547285939
Encrypted:	false
SSDEEP:	6:PzXULmWxHLTpUrhaGbsW3CNcwAFeMmvVOIHJFxMVlmJHaVFhZIhIt3:P+pTpchaGbsTDAFSkIrxMVlmJHaV5t3
MD5:	9EE0B7EDC68864CD9E69E2682823B251
SHA1:	A89692239FCACCDA7C76743DEDF8EB2F244389D3
SHA-256:	0736A9B3859B3B86C63FA64B4ED9DD3B44BC6EC639FD3CDB4DC738AE1C9A7065
SHA-512:	6943B470836443868A1B9A0996F1E866BC7BC0D2EFD7ED22224C53065EB51C4393C369BA8DA99F104D90047C6F021C6F2642C8EC96786790EC6BEE76EF5E963E
Malicious:	false
Reputation:	low
Preview:	..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=8ms TTL=51....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 8ms, Maximum = 8ms, Average = 8ms..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.220509258321107
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	phantomtoolsv2.exe
File size:	2'746'880 bytes
MD5:	0c01cfc0685211b3c655c7a9526f1849
SHA1:	864d23804b6e3c98efd1b56863a484b505ddf40b
SHA256:	8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6
SHA512:	6024a41f371d77a82608c0e8ff314853404a50decb77838ace61c43a72ef954f4a227849b85e2aa3ef0749120e8361f13145006652596fb22b2f972bf7585719
SSDEEP:	49152:EZPf0tL9d77T+WScpPNBqB0+i8jS9fQzm/kv49hISc1HeW6YS3jLqFtJc:TVScpPN3D/8Sc1HeW6YSad
TLSH:	F4D5AF0FEEA748A8C62BC0BC4257A7FA5530F81D126F3DE59AB0DE720EA1DC4571A711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...(..g...............)......)................@.............................`..........`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x670ACB28 [Sat Oct 12 19:16:56 2024 UTC]
TLS Callbacks:	0x4001a380, 0x1, 0x4001a350, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0163d3ec9900198371a13a64f76fc361

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00274A35h]
mov dword ptr [eax], 00000001h
call 00007F1B3D70409Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00274A15h]
mov dword ptr [eax], 00000000h
call 00007F1B3D70407Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F1B3D72A58Ch
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F1B3D7043A9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax+00h]
push esi
push ebx
dec eax
sub esp, 28h
call 00007F1B3D72A632h
dec eax
arpl ax, bx
cdq
dec eax
imul ebx, ebx, 51EB851Fh
dec eax
sar ebx, 25h
sub ebx, edx
imul edx, ebx, 64h
sub eax, edx
mov ebx, eax
test eax, eax
jle 00007F1B3D704408h
xor esi, esi
nop dword ptr [eax+00000000h]
call 00007F1B3D72A608h
dec eax
arpl ax, dx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a0000	0x1180	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x281000	0xaf80	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a4000	0x1684	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x274860	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a0450	0x410	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10bb70	0x10bc00	22459671085291c5063e8c8859bc8f59	False	0.35506481238328663	data	6.228388072256253	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x10d000	0x3080	0x3200	9dd76daa6bcbbd52a7e1f42691b82f36	False	0.0225	data	0.27715409108042194	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x111000	0x16f4a0	0x16f600	0755f03812b806657c2a38e7b4b3dc65	False	0.5951468930758761	data	7.481419958849477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x281000	0xaf80	0xb000	e5a1483ef7d2debd266ba4f8a96810ca	False	0.5372869318181818	data	6.036620350568149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x28c000	0x12324	0x12400	98a30c7b03b41b55b5760cfb36f29449	False	0.1908042594178082	data	5.069165535169385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x29f000	0xcb0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2a0000	0x1180	0x1200	639e2c53a8b3a75c1ff57ec93e18be3b	False	0.314453125	data	4.234187742404477	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x2a2000	0x60	0x200	c763ed33786bdf672a771e19d0ae8b3a	False	0.06640625	data	0.3124937745953951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2a3000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2a4000	0x1684	0x1800	4f4f97b146c1904b770a19b01a0caf58	False	0.37890625	data	5.3554449882646145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CreateFileW, CreateToolhelp32Snapshot, DeleteCriticalSection, EnterCriticalSection, FormatMessageA, GetCurrentProcess, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTempPathA, GetTempPathW, GetThreadId, InitializeConditionVariable, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryW, LocalFree, MultiByteToWideChar, Process32First, Process32Next, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetLastError, SetUnhandledExceptionFilter, Sleep, SleepConditionVariableCS, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualProtect, VirtualQuery, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteFile

msvcrt.dll

__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _commode, _errno, _filelengthi64, _fileno, _fmode, _fstat64, _get_osfhandle, _initterm, _lseeki64, _onexit, _strlwr, _time64, _wfopen, abort, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getenv, getwc, iswctype, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, rand, realloc, setlocale, setvbuf, signal, srand, strchr, strcmp, strcoll, strcpy_s, strerror, strftime, strlen, strncmp, strstr, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcstombs, wcsxfrm, _write, _read, _fileno, _fdopen

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T01:38:09.966420+0200	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.966420+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.966420+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.971752+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49737	79.137.202.152	15666	TCP
2024-10-13T01:38:09.971752+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49737	79.137.202.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:38:05.071024895 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:05.076750994 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:05.076833010 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:05.149701118 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.149784088 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.149880886 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.159274101 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.159306049 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.664544106 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.664673090 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.751516104 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.751564980 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.752638102 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.752814054 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.753916979 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.795407057 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.867691040 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.867849112 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:05.867904902 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.867904902 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.869215965 CEST	49738	443	192.168.2.4	104.26.13.205
Oct 13, 2024 01:38:05.869261026 CEST	443	49738	104.26.13.205	192.168.2.4
Oct 13, 2024 01:38:09.966419935 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.971491098 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971551895 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971580982 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971606970 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971637964 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971664906 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971692085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971751928 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.971836090 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971879959 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971906900 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.971910954 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.971940994 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.971972942 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.976892948 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.976921082 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.976973057 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.976999998 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977026939 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977054119 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977087021 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.977101088 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977128029 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977155924 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977183104 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977209091 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977226019 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.977257013 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977282047 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.977283955 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.977365017 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982270002 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982296944 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982327938 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982384920 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982459068 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982486010 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982495070 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982547045 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982552052 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982597113 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982601881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982672930 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982702017 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982728004 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982758999 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982789993 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982804060 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982824087 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982861996 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.982913017 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982940912 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.982990026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983005047 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983016968 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983043909 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983063936 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983092070 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983094931 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983123064 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983149052 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983150005 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983175993 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983179092 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983222961 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983232975 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983251095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983278990 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983304024 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983309031 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983336926 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.983367920 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.983397007 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987082958 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987111092 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987173080 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987277031 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987427950 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987490892 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987518072 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987546921 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987574100 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987577915 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987605095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987632036 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987673044 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.987673044 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987701893 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.987751961 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988127947 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988189936 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988254070 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988281965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988310099 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988346100 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988401890 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988452911 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988480091 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988506079 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988521099 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988558054 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988562107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988590956 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988616943 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988619089 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988643885 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988656044 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988672018 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988689899 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988699913 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988718987 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988728046 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988746881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988755941 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988785982 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988806963 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988815069 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988833904 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988861084 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988874912 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988888979 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988904953 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988917112 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988945007 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988971949 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.988974094 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.988998890 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989020109 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989027023 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989067078 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989068985 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989097118 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989097118 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989125967 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989128113 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989155054 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989156008 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989183903 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989185095 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989213943 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989237070 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989238024 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989265919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989290953 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989293098 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989320993 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989346981 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989356995 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989373922 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989397049 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989401102 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989432096 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989440918 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989459038 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989485025 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989485979 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989514112 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989518881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989541054 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989557028 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989567995 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989581108 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989594936 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989622116 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989624977 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989649057 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989654064 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989675999 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989680052 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989703894 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989706993 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989729881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989731073 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989758015 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989758968 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989784956 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989793062 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989811897 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989837885 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989847898 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989866018 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989892960 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989897966 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989922047 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.989931107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989957094 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989984989 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.989988089 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.990027905 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.990053892 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992065907 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992120028 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992296934 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992325068 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992351055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992366076 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992383003 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992450953 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992537975 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992564917 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992594957 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992631912 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992640972 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992662907 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992691040 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992693901 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992722034 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992749929 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992777109 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992786884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992814064 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992840052 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.992841005 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992871046 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.992899895 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993002892 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993030071 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993081093 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993105888 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993108034 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993134975 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993141890 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993163109 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993170023 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993199110 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993211985 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993223906 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993240118 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993268013 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.993269920 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993299007 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.993325949 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.994812012 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.994846106 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.994875908 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.994893074 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.994908094 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.994921923 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.994939089 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.994977951 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.994978905 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995004892 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995032072 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995050907 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995084047 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995084047 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995111942 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995138884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995156050 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995166063 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995198965 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995215893 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995225906 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995244980 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995271921 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995280981 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995300055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995316982 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995330095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995347023 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995357037 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995373011 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995415926 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995425940 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995454073 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995481014 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995507956 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995522976 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995538950 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995559931 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995565891 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995593071 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995596886 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995620012 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995625973 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995646954 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995654106 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995675087 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995683908 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995702982 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995712042 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995733023 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995754004 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995759964 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995784998 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995788097 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995812893 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995815039 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995867014 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995867968 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995896101 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995922089 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995949030 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.995961905 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.995980024 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996004105 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996007919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996035099 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996037960 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996062040 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996085882 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996089935 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996113062 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996117115 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996144056 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996145964 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996169090 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996172905 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996201038 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996206999 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996227980 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996241093 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996256113 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996284008 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996284008 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996310949 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996321917 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996336937 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996345043 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996365070 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996377945 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996392965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996419907 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996448040 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996463060 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996496916 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996501923 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996521950 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996534109 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996546030 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996556997 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996568918 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996581078 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996587038 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996592999 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996606112 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996619940 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996632099 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996644974 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996654034 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996656895 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996670008 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996682882 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996695995 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996699095 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996709108 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996721983 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996733904 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996745110 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996752977 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996756077 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996778965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996790886 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996798038 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996803999 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996815920 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996828079 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996840954 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996840954 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996853113 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996865988 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996877909 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996890068 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.996896982 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.996941090 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.997699022 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997730017 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997769117 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997781038 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997802019 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.997834921 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.997845888 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997859955 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997880936 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997893095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.997924089 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.997953892 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.997991085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998003006 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998035908 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998047113 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998065948 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998069048 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998080969 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998092890 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998106003 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998150110 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998157978 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998172045 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998193979 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998205900 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998217106 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998228073 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998239040 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998248100 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998260975 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998274088 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998285055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998289108 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998307943 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998320103 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998327017 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998331070 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998353958 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998367071 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998378038 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:09.998383999 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:09.998423100 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000128984 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000170946 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000181913 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000193119 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000214100 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000225067 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000236034 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000253916 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000288963 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000298023 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000300884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000313997 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000336885 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000348091 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000359058 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000368118 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000370026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000392914 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000406981 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000415087 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000418901 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000431061 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000452042 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000463963 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000463963 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000475883 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000494957 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000526905 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000535011 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000549078 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000561953 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000572920 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000585079 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000596046 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000607014 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000617981 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000622034 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000629902 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000650883 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000663042 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000668049 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000674963 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000686884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000699043 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000710011 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000720978 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000724077 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000731945 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000746965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000758886 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000770092 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.000778913 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.000823021 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.001684904 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001741886 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.001743078 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001756907 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001780987 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001791954 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001827002 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.001862049 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.001868010 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001880884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001903057 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001914978 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001936913 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001949072 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.001957893 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.001993895 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002002001 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002034903 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002043962 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002048016 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002063036 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002111912 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002120972 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002123117 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002140045 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002161026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002190113 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002197027 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002208948 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002228022 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002259016 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002260923 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002273083 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002298117 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002317905 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002337933 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002346992 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002382040 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002384901 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002396107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002408981 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002458096 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002470970 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002482891 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002506971 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002518892 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002541065 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002551079 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002557993 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002597094 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002598047 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002612114 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002624989 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002634048 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002645969 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002650023 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002667904 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002680063 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002680063 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002695084 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002716064 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002727032 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002728939 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002759933 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002779007 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002790928 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002811909 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002823114 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002852917 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002863884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002866983 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002911091 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002916098 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002923965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002949953 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002975941 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.002985954 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.002998114 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003010988 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003022909 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003041983 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003072023 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003096104 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003108025 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003120899 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003166914 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003173113 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003210068 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003217936 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003231049 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003252029 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003272057 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003283024 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003288984 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003294945 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003331900 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003365993 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003367901 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003379107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003411055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003421068 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003437042 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003438950 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003448009 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003484964 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003490925 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003504992 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003516912 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003528118 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003540993 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003550053 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003552914 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003566027 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003576994 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003587961 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003608942 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003609896 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003635883 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003648996 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003660917 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003665924 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003681898 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003695011 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003705978 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003710032 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003719091 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003731012 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003741980 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003752947 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003752947 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003766060 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003789902 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003796101 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003802061 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003814936 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003827095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003838062 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003842115 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003849983 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003864050 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003875971 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.003878117 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003911018 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.003947020 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.048144102 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.052335024 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.052541018 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.052647114 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.052777052 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.052875996 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053020000 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053118944 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053245068 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053345919 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053468943 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053570986 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053714991 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.053795099 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.063210964 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.063277960 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.063359022 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.063668013 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.063889027 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.064011097 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.064165115 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.064274073 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.064399958 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.064513922 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.105249882 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.108038902 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.155982971 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.160147905 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.163093090 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.163417101 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.163649082 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.163789988 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.163913012 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164017916 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164139032 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164233923 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164381027 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164478064 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164603949 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164697886 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164860010 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.164957047 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.165095091 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.165134907 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.168518066 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.172039986 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.216195107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.220279932 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.220503092 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.220608950 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.220740080 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.220834970 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.220971107 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.221067905 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.221194029 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.221292019 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.221426010 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.221493959 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.225501060 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.228293896 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.228497982 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.228619099 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.228738070 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.268163919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.272304058 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.272507906 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.272615910 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.299961090 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.300204039 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.300570965 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.300786972 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.300894976 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.301039934 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.301101923 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.305682898 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.308254957 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.308486938 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.308600903 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.308726072 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.308789015 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.348035097 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.352147102 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.365504026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.365516901 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.365967989 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366190910 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366309881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366455078 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366559982 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366684914 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.366858959 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.367007017 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.367057085 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.371037960 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.372466087 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.372673988 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.372781992 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.372909069 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.373008013 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.373147011 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.373187065 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.412110090 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.416179895 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.425987959 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.426435947 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.428288937 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.428524971 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.428634882 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.428746939 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.428848028 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.428966999 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429066896 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429197073 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429295063 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429429054 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429524899 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429651976 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429750919 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.429897070 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.430000067 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.430114985 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.433500051 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433516026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433525085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433547020 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433556080 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433563948 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433579922 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433587074 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433594942 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433700085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433707952 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433716059 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433732986 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433739901 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433748960 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433757067 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433763981 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433772087 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433866024 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433873892 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433881044 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433887959 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.433893919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433902979 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433909893 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433938980 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433954000 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.433963060 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434034109 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434041977 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434048891 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434056997 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434067011 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.434071064 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434078932 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.434146881 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.475900888 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.476300955 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.476526976 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.476644039 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.476766109 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.476865053 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.476980925 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477077007 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477219105 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477322102 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477452993 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477555037 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477684021 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477790117 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477932930 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.477982044 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.481792927 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.481810093 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.481842995 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.481904030 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.481980085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.481987953 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482031107 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482038975 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482047081 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482062101 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482069969 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482139111 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482147932 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482156992 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482165098 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482161999 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482203960 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482213020 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482222080 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482229948 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482301950 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482311010 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482321024 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482328892 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482336998 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482342005 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482352972 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482361078 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482368946 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482377052 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482384920 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482459068 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482479095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482489109 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482496977 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482506037 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482513905 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482522011 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482530117 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482537985 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482552052 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482559919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482567072 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482575893 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482584000 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482585907 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482592106 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482600927 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482609034 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482618093 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482626915 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482635021 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482642889 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482650042 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482656956 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482665062 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482671976 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482680082 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482690096 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482697964 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482723951 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482732058 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482739925 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482748032 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482755899 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482842922 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482848883 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482857943 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482865095 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482873917 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482882023 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482888937 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482897043 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482930899 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482943058 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482954025 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.482961893 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482975006 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482983112 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.482991934 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483000040 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483007908 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483016014 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483023882 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483031988 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483040094 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483047962 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483077049 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483089924 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483099937 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483108044 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483115911 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483122110 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483129978 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483138084 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483156919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483160019 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483165979 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483174086 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483181953 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483190060 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483207941 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483216047 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483223915 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483232021 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483241081 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483249903 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483257055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483264923 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483273029 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483280897 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483288050 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483297110 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483304977 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483313084 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483313084 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483320951 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483329058 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483349085 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483356953 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483365059 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483376026 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483395100 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483402967 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483411074 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483417988 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483421087 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483434916 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483445883 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483454943 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483463049 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483474016 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483496904 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483506918 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483555079 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483592033 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483602047 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483609915 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483618975 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483627081 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483633995 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483643055 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483659029 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483666897 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483673096 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483675003 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483684063 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483692884 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483700991 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483709097 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483716965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483721018 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483724117 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483737946 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483737946 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483745098 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483767033 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483776093 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483797073 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483805895 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483809948 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483813047 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483823061 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483830929 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483839989 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483875036 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483875036 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483894110 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483903885 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483911991 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483918905 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483927965 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483935118 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.483936071 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483954906 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483964920 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483984947 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.483993053 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484000921 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484000921 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484010935 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484019995 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484028101 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484035969 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484045029 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484051943 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484054089 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484112024 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484113932 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484122992 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484131098 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484139919 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484149933 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484158993 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484160900 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484168053 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484179020 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484186888 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484194994 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484210014 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484214067 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484217882 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484225988 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484235048 CEST	15666	49737	79.137.202.152	192.168.2.4
Oct 13, 2024 01:38:10.484281063 CEST	49737	15666	192.168.2.4	79.137.202.152
Oct 13, 2024 01:38:10.484297991 CEST	15666	49737	79.137.202.152	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 01:38:05.136153936 CEST	192.168.2.4	1.1.1.1	0x83a0	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 01:38:05.142924070 CEST	1.1.1.1	192.168.2.4	0x83a0	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:38:05.142924070 CEST	1.1.1.1	192.168.2.4	0x83a0	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:38:05.142924070 CEST	1.1.1.1	192.168.2.4	0x83a0	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	104.26.13.205	443	7360	C:\Users\user\Desktop\phantomtoolsv2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-12 23:38:05 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-10-12 23:38:05 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 23:38:05 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d1aebea4f040fa8-EWR
2024-10-12 23:38:05 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	19:38:03
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\phantomtoolsv2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\phantomtoolsv2.exe"
Imagebase:	0x7ff7b8800000
File size:	2'746'880 bytes
MD5 hash:	0C01CFC0685211B3C655C7A9526F1849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:38:04
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\phantomtoolsv2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\phantomtoolsv2.exe"
Imagebase:	0x7ff7b8800000
File size:	2'746'880 bytes
MD5 hash:	0C01CFC0685211B3C655C7A9526F1849
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:38:21
Start date:	12/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\phantomtoolsv2.exe"
Imagebase:	0x7ff794cc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:38:21
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:38:21
Start date:	12/10/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 1.1.1.1 -n 1 -w 3000
Imagebase:	0x7ff69e050000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.4%
Total number of Nodes:	1614
Total number of Limit Nodes:	20

Executed Functions

Function 00007FF7B8803C70 Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 376
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B8803C83

Part of subcall function 00007FF7B8803060: GetCurrentProcess.KERNEL32 ref: 00007FF7B8803071
Part of subcall function 00007FF7B8803060: GetTempPathA.KERNEL32 ref: 00007FF7B88030C8
Part of subcall function 00007FF7B8803060: strlen.MSVCRT ref: 00007FF7B88031E7

GetTempPathW.KERNEL32 ref: 00007FF7B8803CEA
wcslen.MSVCRT ref: 00007FF7B8803D0B
wcslen.MSVCRT ref: 00007FF7B8803D29

Part of subcall function 00007FF7B88F5AE0: memcpy.MSVCRT ref: 00007FF7B88F5B18

strlen.MSVCRT ref: 00007FF7B8803E21
LoadLibraryA.KERNEL32 ref: 00007FF7B8803ED1
GetProcAddress.KERNEL32 ref: 00007FF7B8803EEB
GetProcAddress.KERNEL32 ref: 00007FF7B8803F44
GetProcAddress.KERNEL32 ref: 00007FF7B8803F94
wcslen.MSVCRT ref: 00007FF7B8803FE3
LdrLoadDll.NTDLL ref: 00007FF7B88040A4
GetProcAddress.KERNEL32 ref: 00007FF7B88040C3
VirtualProtect.KERNEL32 ref: 00007FF7B88040E0
LdrUnloadDll.NTDLL ref: 00007FF7B88040EF

Strings

:a.dll, xrefs: 00007FF7B8803FD9
zSJlTWS\Execute, xrefs: 00007FF7B8803F4C
LdrLoadDll, xrefs: 00007FF7B8803EE1
B, xrefs: 00007FF7B8803F6D
basic_string: construction from null is not valid, xrefs: 00007FF7B8804314
Z{,-, xrefs: 00007FF7B8803FF5
basic_string::append, xrefs: 00007FF7B88042F3, 00007FF7B8804320
4.&.Z{,-, xrefs: 00007FF7B880406F
a.dll, xrefs: 00007FF7B8803D1F

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: AddressProc$wcslen$CurrentLoadPathProcessTempstrlen$LibraryProtectUnloadVirtualmemcpy
String ID: 4.&.Z{,-$:a.dll$B$LdrLoadDll$Z{,-$a.dll$basic_string: construction from null is not valid$basic_string::append$zSJlTWS\Execute
API String ID: 2265943254-318193387
Opcode ID: e7bbd5f123d5df9470509c441783b5eb9e2c02f86aa84f5f481f50c67e0b9a61
Instruction ID: 4918ad2fc6817e1bd663775ab98959120967658cd985375c3d3901559d9192f4
Opcode Fuzzy Hash: e7bbd5f123d5df9470509c441783b5eb9e2c02f86aa84f5f481f50c67e0b9a61
Instruction Fuzzy Hash: A8F1C422619B8682DB24EB19E4403AAF7A1FB96B84FC04131DB9E47B9CDF3CD516C714

Function 00007FF7B88034D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B890AB80: malloc.MSVCRT ref: 00007FF7B890AB97

memcpy.MSVCRT ref: 00007FF7B8803516

Strings

basic_string::append, xrefs: 00007FF7B8803C06, 00007FF7B8803C44, 00007FF7B8803C55

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: mallocmemcpy
String ID: basic_string::append
API String ID: 4276657696-3811946249
Opcode ID: 478d52fa18d52d4defbd28d3cf3a57e33f6739e4ce9177ee6136c2b9cf404ec1
Instruction ID: a3170213af9eabd2335e6d4ce007a75ff09eea06577a0b188108f95c17933914
Opcode Fuzzy Hash: 478d52fa18d52d4defbd28d3cf3a57e33f6739e4ce9177ee6136c2b9cf404ec1
Instruction Fuzzy Hash: 00D1963261CBC582EA60AB19E50076EE3A1FB96790F804231DBAD47B9DDF3CD456C718

Function 00007FF7B8803060 Relevance: 7.7, APIs: 5, Instructions: 231
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B8803071
GetTempPathA.KERNEL32 ref: 00007FF7B88030C8
strlen.MSVCRT ref: 00007FF7B88031E7
strlen.MSVCRT ref: 00007FF7B88032A9
memcpy.MSVCRT ref: 00007FF7B88032EE

Part of subcall function 00007FF7B883EE70: memchr.MSVCRT ref: 00007FF7B883EEB1

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen$CurrentPathProcessTempmemchrmemcpy
String ID:
API String ID: 1237187527-0
Opcode ID: b8ce6924fedb661b87884fb1d263ab3edc801dc2d5a500a0fb930ce7753d2c66
Instruction ID: 04ce81bc967ca1c5d2d944a41b424c57d0a0eccb9b6a6248310eabb2d85f633c
Opcode Fuzzy Hash: b8ce6924fedb661b87884fb1d263ab3edc801dc2d5a500a0fb930ce7753d2c66
Instruction Fuzzy Hash: C0A19322618B8582EB109B19E44036AE7A1FB96BD0F944235EFAD47BDCDF7CD016CB14

Function 00007FF7B88011D9 Relevance: 7.6, APIs: 5, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62107a3d02b81b5234c88d95762d057ed00c24eaffb834b4604cbe2bde97a6a7
Instruction ID: 8239d3963cb419e2b5a469c8baffa7394d82785ef4b7c88553857d72cca3e8ca
Opcode Fuzzy Hash: 62107a3d02b81b5234c88d95762d057ed00c24eaffb834b4604cbe2bde97a6a7
Instruction Fuzzy Hash: FC419328A2E64686EA11BF5DE451678E3D5AF27B90FC44034CB1C4735DDE2CE4238328

Function 00007FF7B88046A4 Relevance: 4.6, APIs: 3, Instructions: 128
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7B881BB40: RtlCaptureContext.KERNEL32 ref: 00007FF7B881BBBE
Part of subcall function 00007FF7B881BB40: RtlUnwindEx.KERNEL32 ref: 00007FF7B881BBDC
Part of subcall function 00007FF7B881BB40: abort.MSVCRT ref: 00007FF7B881BBE2

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7B8804735
Process32First.KERNEL32 ref: 00007FF7B880475A

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CaptureContextCreateFirstProcess32SnapshotToolhelp32Unwindabort
String ID:
API String ID: 1927501140-0
Opcode ID: 4b6a83684ab022a88defd8bcf5abd0d0cb42e06d483728e8715a84bc4aae11ba
Instruction ID: 37546f53057cfab7b4f4763bdd8832101b55644b6a7322cf59b578cde26927d1
Opcode Fuzzy Hash: 4b6a83684ab022a88defd8bcf5abd0d0cb42e06d483728e8715a84bc4aae11ba
Instruction Fuzzy Hash: 4541E72261868682EA24BB19E4002BEE3A1FB97794FC44531EF5D0779EDF7CD4538714

Function 00007FF7B8803539 Relevance: 6.0, APIs: 4, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7B880356D
WriteFile.KERNEL32 ref: 00007FF7B880359D
CloseHandle.KERNEL32 ref: 00007FF7B88035AE
CloseHandle.KERNEL32 ref: 00007FF7B88038C0

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: 394c0e051cec6e34f4efdc98b69a1e23df70269413b6b1c3fb0bf7fe79d9565c
Instruction ID: 5f00c2508c001f642ad69ca3496d05a8d3cc37ff09261c5b36bb7aaaa6469424
Opcode Fuzzy Hash: 394c0e051cec6e34f4efdc98b69a1e23df70269413b6b1c3fb0bf7fe79d9565c
Instruction Fuzzy Hash: 3711A32271954683F620AB19F41476BE291BB95BA8F800230DF6D0BAD8CF3CE44A8758

Function 00007FF7B8801294 Relevance: 5.1, APIs: 4, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF7B8801312
strlen.MSVCRT ref: 00007FF7B8801334
malloc.MSVCRT ref: 00007FF7B8801340
memcpy.MSVCRT ref: 00007FF7B8801358

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 543d9a2a041976af41462432e31a9754b6760f675d962eca3c3379e79177352a
Instruction ID: 517c292c76a2f95ecb518a089f383652a8b04a73aef38b547042cb0784babe93
Opcode Fuzzy Hash: 543d9a2a041976af41462432e31a9754b6760f675d962eca3c3379e79177352a
Instruction Fuzzy Hash: 8A31A129A2E64686E711BF5DE851774E3D5AF63790FC44038CF1C07399EE2DA426C728

Function 00007FF7B8801289 Relevance: 5.1, APIs: 4, Instructions: 74
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF7B8801312
strlen.MSVCRT ref: 00007FF7B8801334
malloc.MSVCRT ref: 00007FF7B8801340
memcpy.MSVCRT ref: 00007FF7B8801358

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 56020effcdf1f183f441924a68ad24072c27b0678ef036c8d0d284124bb19e98
Instruction ID: 65392593c8a84e136a3c923601edd2817952fada968d89c28b1ada0b7b8a2d8d
Opcode Fuzzy Hash: 56020effcdf1f183f441924a68ad24072c27b0678ef036c8d0d284124bb19e98
Instruction Fuzzy Hash: 5D317029E2E60686E601BF5DE841778E390AF62791F844074DF1C07399DE3CE463C728

Function 00007FF7B881B690 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32 ref: 00007FF7B881B694

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 348af94818ab9c865733835cec085adb7e283a79ab7aac6c44221e6ed0fb0604
Instruction ID: d5db7deaeef3d550e1a92f826f69ab1022a36da14ab16d5a3f8f0d00268f4f04
Opcode Fuzzy Hash: 348af94818ab9c865733835cec085adb7e283a79ab7aac6c44221e6ed0fb0604
Instruction Fuzzy Hash: B7C04C14F5B543C2E654377A5C42522D1D07B6AB40FD05434C60895554DD6CA1E74675

Function 00007FF7B890AB80 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF7B890AB97

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 988b4ae5ae706df390a6233965e24e8829ae3f9e1bccf5fff257dc606ecde792
Instruction ID: db2ed813a7801957f066c1f95215c65cc6c94eab385234984bd4916bade7fa57
Opcode Fuzzy Hash: 988b4ae5ae706df390a6233965e24e8829ae3f9e1bccf5fff257dc606ecde792
Instruction Fuzzy Hash: 34D0C710B1A3474AFD5D769919513B4C1C10FBA702F480434DF5E853C6ED1C74424775

Non-executed Functions

Function 00007FF7B8815B20 Relevance: 15.7, APIs: 4, Strings: 6, Instructions: 698stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00007FF7B8815B61
strlen.MSVCRT ref: 00007FF7B8815C6E

Strings

_, xrefs: 00007FF7B8815BBD
Z, xrefs: 00007FF7B8815D2E
_, xrefs: 00007FF7B8815F32
_, xrefs: 00007FF7B8815D21
Z, xrefs: 00007FF7B8815BC7
_GLOBAL_, xrefs: 00007FF7B8815B57

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlenstrncmp
String ID: Z$Z$_$_$_$_GLOBAL_
API String ID: 1310274236-662103887
Opcode ID: 67900ba0dafbe8d0e4433077726af768059a8f719d3a5e9100497bef6a6a133d
Instruction ID: e1f5d2aae648cb32d16db648bedbda8c2896f6cfe8ec4d55d1177f5aa629a19b
Opcode Fuzzy Hash: 67900ba0dafbe8d0e4433077726af768059a8f719d3a5e9100497bef6a6a133d
Instruction Fuzzy Hash: 4462C572A286828BF764EE29C4543F9E7A0BB2A748F904035DB4E47789CF39D552C714

Function 00007FF7B881D367 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 431COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7B881E0B6

Strings

, xrefs: 00007FF7B881DEC0
P, xrefs: 00007FF7B881E9B3
P, xrefs: 00007FF7B881E454

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memset
String ID: $P$P
API String ID: 2221118986-3733749394
Opcode ID: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction ID: 3bd357a90efdfc30838ec67fa8bb92fd3805cbe79c008201424f2698b6ed4190
Opcode Fuzzy Hash: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction Fuzzy Hash: E612823292C28287E760BF29D0407BEF791FBAA744F804135DB4947689DF7CE4568B64

Function 00007FF7B8804350 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880440C
strcmp.MSVCRT ref: 00007FF7B880445C

Strings

B, xrefs: 00007FF7B8804382
B, xrefs: 00007FF7B8804415
B, xrefs: 00007FF7B88043C6
h}/9, xrefs: 00007FF7B880442B
I^2$, xrefs: 00007FF7B880437A

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: B$B$B$I^2$$h}/9
API String ID: 1004003707-632112022
Opcode ID: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction ID: 76c101f178a4d2c4408261cccc7fcf3712666e2a7c6c2ebe59865dcfdf5d0fef
Opcode Fuzzy Hash: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction Fuzzy Hash: 61312772A0D78587DB219F29E0402AAFBA0E7A6788FC44135EB8D07B48DB7CC512CF54

Function 00007FF7B881DA84 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 359COMMON

Download Yara Rule

Strings

!, xrefs: 00007FF7B881EC5B
P, xrefs: 00007FF7B881E9B3
, xrefs: 00007FF7B881E59E

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: $!$P
API String ID: 0-2344582389
Opcode ID: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction ID: 9ef4b1e6db54fe38d39d0e339fc83112036844567e9c950130fed250da0eafef
Opcode Fuzzy Hash: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction Fuzzy Hash: 09F1E33292C68587E770BF18D0443BAF7A2EBAA340F808135DB4953789DF7CE4568B24

Function 00007FF7B881C4A0 Relevance: 4.8, APIs: 3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e773bbcf05a206fa72d67c052939a87a5037e1002fc13afee4ac7b2a9d1dd5
Instruction ID: 488f7bbb2fe322a9fe9cae434a4d91b1f2fa1c8efafac6c0182307fa59645b07
Opcode Fuzzy Hash: b2e773bbcf05a206fa72d67c052939a87a5037e1002fc13afee4ac7b2a9d1dd5
Instruction Fuzzy Hash: FEC1DB72A281428BE764EE1AD44067EF791FBA9744F845034EB0A4779DDE3CE8128F54

Function 00007FF7B8825140 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7B88252B4

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7722b09541f8c3a1042df91a4b64b4147f17cf3696f4ae9f4b099ea08ef108bb
Instruction ID: 9d8f18ccb3d0953f7f72f0987129a53e1dbbbf72c623e13f1b6173fb93a42182
Opcode Fuzzy Hash: 7722b09541f8c3a1042df91a4b64b4147f17cf3696f4ae9f4b099ea08ef108bb
Instruction Fuzzy Hash: D9D1E362B6859147EBA49F1D850437DEB92BBA6784FC8C131DB1D473C8DA3CEA22C714

Function 00007FF7B88264F0 Relevance: 2.6, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF7B882661E
LeaveCriticalSection.KERNEL32 ref: 00007FF7B8826650

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalLeaveSectionmalloc
String ID:
API String ID: 2116668948-0
Opcode ID: 40c92fb735db31c4a03f034ad08b64e87eddef291a1e133e22cfab3f13ba580c
Instruction ID: c5e081e4684bd14313baadda97098aab351258b065b61dc7efc18752c08320a2
Opcode Fuzzy Hash: 40c92fb735db31c4a03f034ad08b64e87eddef291a1e133e22cfab3f13ba580c
Instruction Fuzzy Hash: 5751F6B1A2824287E71C9F1DF504B76BA91EBB1744F918139CB0A07BD8CA3CD552C794

Function 00007FF7B88E7220 Relevance: 1.8, Strings: 1, Instructions: 556COMMON

Download Yara Rule

Strings

Result of , xrefs: 00007FF7B88E7222

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: Result of
API String ID: 0-1275385331
Opcode ID: df9895d686224d2dd2c7e99c3ab68119a663b6e2dd92d436c381b666f5179717
Instruction ID: ea5cc48deee741046bfffa42cab7caf6571e8054d08a1f3c1767bad800676c9e
Opcode Fuzzy Hash: df9895d686224d2dd2c7e99c3ab68119a663b6e2dd92d436c381b666f5179717
Instruction Fuzzy Hash: 4382EA64D09A4781FB01BB0DE8457B5F3A0BF66B46FC00235CA6C87269DF7DA14793A8

Function 00007FF7B88FC950 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

Result of , xrefs: 00007FF7B88FC952

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: Result of
API String ID: 0-1275385331
Opcode ID: 71862e91d9851ec66f4449fbeb5876b1467cb8c043c6da86588d3d223f86607d
Instruction ID: c776825f421c8a9b5a6053a6cafa675400ce41597975b9257ddd5b2c8039d69a
Opcode Fuzzy Hash: 71862e91d9851ec66f4449fbeb5876b1467cb8c043c6da86588d3d223f86607d
Instruction Fuzzy Hash: 7AF1C232A14B8283E314DF29E4543AEB3A0FB65748F808625CBAD07795DF7CE1A5D348

Function 00007FF7B881B500 Relevance: 1.5, APIs: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B881B50D

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 9942ccc97f5f8416b775898699d47bf50dda6b0e8bd8ff5c80a888a791faa8a4
Instruction ID: ab609dc9328a27be77a32296d9a1f5d1e66b3b53c80318ac9da3a192ca276232
Opcode Fuzzy Hash: 9942ccc97f5f8416b775898699d47bf50dda6b0e8bd8ff5c80a888a791faa8a4
Instruction Fuzzy Hash: C8F02793B2560883CF18DB78E865174D362AB58FC9B489831CB0F8BB38EE2CD1428200

Function 00007FF7B890C460 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 00007FF7B890C472

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/):
API String ID: 0-1835032153
Opcode ID: 8e620f959c4aa112b31ede506d0c5fb51523c1f977658e3e8e59d1e508d8e11f
Instruction ID: 3bd5d926d8782ba0a9717b676c0862d85bfd860f39a1df94a753c8c461d8f724
Opcode Fuzzy Hash: 8e620f959c4aa112b31ede506d0c5fb51523c1f977658e3e8e59d1e508d8e11f
Instruction Fuzzy Hash: 3E31B511B1964796EE24FB2998502AAE361BF66BC4FC00132EB6D177DDDE2CE107C354

Function 00007FF7B8806A40 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction ID: bfa7b3209dc0f98e0906998880f1b7a85756b6adc66b10db8c00574d3ef76f5a
Opcode Fuzzy Hash: 26e0fa4ba8de209f33d981733c211bfc04209555fe558efc360ad56f06d6f81b
Instruction Fuzzy Hash: 6B12B662E2EB4282FB60A708E44177AE6D1DF63780FD58431CB6C07789DE3DE5668364

Function 00007FF7B8807290 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d695400308593cf20877fba39419934d70e09c66bbd3b3c0be29ad461eb275a
Instruction ID: 751f1021127655ae3bfd62adc36dcc68e9997e95274269d337e8b82a80e8c594
Opcode Fuzzy Hash: 7d695400308593cf20877fba39419934d70e09c66bbd3b3c0be29ad461eb275a
Instruction Fuzzy Hash: BD12C572E1974287E724BF19944037AE6D1EB66B84F944034CB6D0778DDE3EE862C394

Function 00007FF7B890C950 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CaptureContextUnwindabortstrlen
String ID:
API String ID: 1885994862-0
Opcode ID: 0c9b34f1559c4bde3c9d00a4327f081f1601058a817002645cea0a004f1f74ca
Instruction ID: 208b4f9c4153614bf702c4d4c1350fb50cae9af25030cf49f41a44feceed78c6
Opcode Fuzzy Hash: 0c9b34f1559c4bde3c9d00a4327f081f1601058a817002645cea0a004f1f74ca
Instruction Fuzzy Hash: CB411C50D1D28749FE21B72DA8043B5EA806F77B85F840235DA6D4639ECFACA0478379

Function 00007FF7B8AA0550 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345812ff67cbd8d8fae4febdf0f35f1a69c95c8bef43ce55a609d45bba2dc031
Instruction ID: d9c1874a3ea145252839816673f952b7f84862dcd1ae49567733a36ef0fc09e0
Opcode Fuzzy Hash: 345812ff67cbd8d8fae4febdf0f35f1a69c95c8bef43ce55a609d45bba2dc031
Instruction Fuzzy Hash: 73E03087E1FEC7C5F352A15C0CA942DEDD09A73500B4DD06ACB482A6979C1B2C0543A5

Function 00007FF7B881C1E0 Relevance: 33.1, APIs: 11, Strings: 11, Instructions: 88
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF7B881C1EF
strcmp.MSVCRT ref: 00007FF7B881C206
strcmp.MSVCRT ref: 00007FF7B881C21D
strcmp.MSVCRT ref: 00007FF7B881C234
strcmp.MSVCRT ref: 00007FF7B881C24B
strcmp.MSVCRT ref: 00007FF7B881C262
strcmp.MSVCRT ref: 00007FF7B881C279
strcmp.MSVCRT ref: 00007FF7B881C290
strcmp.MSVCRT ref: 00007FF7B881C2A7
strcmp.MSVCRT ref: 00007FF7B881C2BA
strcmp.MSVCRT ref: 00007FF7B881C2CD

Strings

xdigit, xrefs: 00007FF7B881C2C3
space, xrefs: 00007FF7B881C29D
alnum, xrefs: 00007FF7B881C1E5
digit, xrefs: 00007FF7B881C22A
upper, xrefs: 00007FF7B881C2B0
graph, xrefs: 00007FF7B881C241
lower, xrefs: 00007FF7B881C258
print, xrefs: 00007FF7B881C26F
punct, xrefs: 00007FF7B881C286
cntrl, xrefs: 00007FF7B881C213
alpha, xrefs: 00007FF7B881C1FC

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: alnum$alpha$cntrl$digit$graph$lower$print$punct$space$upper$xdigit
API String ID: 1004003707-2937198513
Opcode ID: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction ID: 02e630f69285345c8a206e23744784a2df13370dbae9f189872e1d73f7e91f1e
Opcode Fuzzy Hash: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction Fuzzy Hash: 0D31EA64A2E20383FA54BF5F9801775D2465F6A380FC46031DB0D866CDEE5CE866E23D

Function 00007FF7B881B8D0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF7B881B9A5
abort.MSVCRT ref: 00007FF7B881B9AB
RtlUnwindEx.KERNEL32 ref: 00007FF7B881BAC1

Strings

CCG", xrefs: 00007FF7B881B932
CCG!, xrefs: 00007FF7B881B998
CCG!, xrefs: 00007FF7B881B8F9
CCG , xrefs: 00007FF7B881B93E
CCG , xrefs: 00007FF7B881BB26

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3297834124
Opcode ID: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction ID: 1d53d645c5d6e4cda7000674acce4fcea8d5104b57afb763fc25b23b7e491779
Opcode Fuzzy Hash: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction Fuzzy Hash: 0D51C632A14B8182E760AB59E4447A9B370F79EB84F505226EF8D13768EF3DD993C704

Function 00007FF7B881FFD0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B88202B5

Strings

UUUU, xrefs: 00007FF7B88200FE

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction ID: 1c6bcf170e97eebd1e41345d29a30d77e0b82f43322699474aeda622261c03f4
Opcode Fuzzy Hash: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction Fuzzy Hash: B5127772D2810287E765AF2DC150739F7E1EB66B58F948235CB0D466CCDA38E852CB68

Function 00007FF7B881ADC0 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B881AE21
TlsGetValue.KERNEL32(?,?,?,00007FF7B881A375), ref: 00007FF7B881AE4A
GetLastError.KERNEL32(?,?,?,00007FF7B881A375), ref: 00007FF7B881AE4F
LeaveCriticalSection.KERNEL32 ref: 00007FF7B881AE77
free.MSVCRT ref: 00007FF7B881AEB7
DeleteCriticalSection.KERNEL32 ref: 00007FF7B881AEDD
InitializeCriticalSection.KERNEL32 ref: 00007FF7B881AF77

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction ID: 7d992e43b2596a16d3dbbc4e9fc4816c17d4d064b4d823b47f4e26cc2158f521
Opcode Fuzzy Hash: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction Fuzzy Hash: D8412E21A2E50287FA55BB59E840678E250AF7BB91FDC4435CB0D47698EF3CE8538368

Function 00007FF7B8820800 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B8820AB5

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction ID: 61e25ce6bcb22854549b2a7df8ada9f839f9436a871eaf9d3151e7afb4576115
Opcode Fuzzy Hash: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction Fuzzy Hash: 6DE188B2A241018BE774AF29C150739F7E1EB66B58FA58235CB094778CDA38EC52CF54

Function 00007FF7B8802F30 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7B8802F81
GetProcAddress.KERNEL32 ref: 00007FF7B8802FD0
wcslen.MSVCRT ref: 00007FF7B8803016

Strings

TEMP, xrefs: 00007FF7B8802FD6
basic_string: construction from null is not valid, xrefs: 00007FF7B8803050
4.&., xrefs: 00007FF7B8802FA8
J, xrefs: 00007FF7B8802F8F

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: AddressLibraryLoadProcwcslen
String ID: 4.&.$J$TEMP$basic_string: construction from null is not valid
API String ID: 1064947497-679671853
Opcode ID: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction ID: b8f04a880d77ab0e59db24c152d29ec9f335aa637cdc36f0a1e11ccb38eaad12
Opcode Fuzzy Hash: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction Fuzzy Hash: 8831E432619A8693EB12AB18E4006AAF760FB96B84FC04032DB9D17B5CDF3CD517C758

Function 00007FF7B881BBF0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF7B881BC22
RaiseException.KERNEL32 ref: 00007FF7B881BC44
abort.MSVCRT ref: 00007FF7B881BC70
RaiseException.KERNEL32 ref: 00007FF7B881BCB7

Strings

CCG , xrefs: 00007FF7B881BC1D
CCG", xrefs: 00007FF7B881BC3F
CCG", xrefs: 00007FF7B881BCB2

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction ID: 0b8a6adebb48c40bd0660d5dc0db1d1ed6ca430e3a10adc7277ace55c66f73e0
Opcode Fuzzy Hash: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction Fuzzy Hash: C7219133A25B8187E340DF58E4403A97760F7D9788F60A22AEA8D57764EF7AC1928700

Function 00007FF7B8825C10 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7B8825C87
LeaveCriticalSection.KERNEL32 ref: 00007FF7B8825CBD

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 0ec2b4e6d6c535e2a887363803070b15498508364dcae1917e8e010573d5d365
Instruction ID: 1412ca6f12abc74460b03ead7f8725540503f0a1e29805ebfece82d622953c04
Opcode Fuzzy Hash: 0ec2b4e6d6c535e2a887363803070b15498508364dcae1917e8e010573d5d365
Instruction Fuzzy Hash: D0917331A5A64286EB94AF1DD945378E2A1BF26780FC44532CB0D0779CEF3CE4638368

Function 00007FF7B8802600 Relevance: 10.6, APIs: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7B88026EA
strcpy_s.MSVCRT ref: 00007FF7B880272E
strcpy_s.MSVCRT ref: 00007FF7B8802741
strcpy_s.MSVCRT ref: 00007FF7B880274F
_strlwr.MSVCRT ref: 00007FF7B8802755
_strlwr.MSVCRT ref: 00007FF7B880275E
strstr.MSVCRT ref: 00007FF7B880276A

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction ID: ed20c43e651065d40d348aacd5dd802e9c45fe48de6fde3cc156a905358ad263
Opcode Fuzzy Hash: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction Fuzzy Hash: 6F419362208BC1D6DB219F19E8407AAE7A5F79ABD4F804121EF4D17B98CF7CD142C704

Function 00007FF7B881F340 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B881F4C2
fputc.MSVCRT ref: 00007FF7B881F53A
fputc.MSVCRT ref: 00007FF7B881F592

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction ID: 5236659b8bfcb8fb7feaf862593e814572aa2b847969d7f5805c4e7ff6bfd7ef
Opcode Fuzzy Hash: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction Fuzzy Hash: 60F1DA62E2858247E761BF2D9004739E691AB2A768F948234CB1D57BC8CE3CFC53C764

Function 00007FF7B8826EA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF7B8826ECB
___lc_codepage_func.MSVCRT ref: 00007FF7B8826ED3
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7B8826F23
MultiByteToWideChar.KERNEL32 ref: 00007FF7B8826F55

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction ID: 62a70c5c421fe129b6ff5ccdad0238f9b936d3ebd1856f8d07055812e7f60570
Opcode Fuzzy Hash: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction Fuzzy Hash: C3314E23B192128BEB52AF19E800779E5506F627B8F844236EF68477C8DE3DD057C714

Function 00007FF7B8801E18 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

rand.MSVCRT ref: 00007FF7B8801E18
rand.MSVCRT ref: 00007FF7B8801E35
rand.MSVCRT ref: 00007FF7B8801E5A

Strings

+-*/, xrefs: 00007FF7B8801E7C
Performing arithmetic operations on: , xrefs: 00007FF7B8801E73
and , xrefs: 00007FF7B8801E97

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: rand
String ID: and $+-*/$Performing arithmetic operations on:
API String ID: 415692148-3864222635
Opcode ID: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction ID: 4111870597fb064845dc8e3534a5d5ef0671d5b364bc2731dbf3a1dd748c6219
Opcode Fuzzy Hash: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction Fuzzy Hash: C5214902F1A61746EA15BA2E884527DD2926FD3B80FC89031DF1D0B39EDD3CE9028368

Function 00007FF7B8804480 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B8804605

Strings

@, xrefs: 00007FF7B880459E
MF3A, xrefs: 00007FF7B880456F
>, xrefs: 00007FF7B880451E
@, xrefs: 00007FF7B88044EC

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: HandleModule
String ID: >$@$@$MF3A
API String ID: 4139908857-2332176444
Opcode ID: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction ID: 1c4fc895c93ca8fe385ae989af06836db4e5fc0da9a232b9b4f0a669a90514ef
Opcode Fuzzy Hash: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction Fuzzy Hash: 6B41B132A09BC582DB219B18F0407AAF7A0F79A748FC14526DB8D03B5CEB7DD556CB44

Function 00007FF7B88F0A00 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

basic_string::_M_create, xrefs: 00007FF7B88F0B49, 00007FF7B88F0BE2, 00007FF7B88F0C72, 00007FF7B88F0D02, 00007FF7B88F0D92

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: basic_string::_M_create
API String ID: 0-3122258987
Opcode ID: 20fa1f9c38397dc2b23d1681f4029f1745706513a81d31012c60e506a3e6e86a
Instruction ID: 3d8c2585763da543424a8c75d215488018768c3fe1df2abff2dc060a936849f5
Opcode Fuzzy Hash: 20fa1f9c38397dc2b23d1681f4029f1745706513a81d31012c60e506a3e6e86a
Instruction Fuzzy Hash: 0EA1FD62B2564689ED24BF19D8400B8E251AF76BE4FD88631DF2D473D5DF2CE4A2C314

Function 00007FF7B881F9C0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction ID: ea3a16e4bd8444678ebc841e2bf61648690cb61ee83fa8306aa05157ec32abb8
Opcode Fuzzy Hash: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction Fuzzy Hash: 93C16372E2915287E761BE28C014339F7A1EB69B58F998231CB0D57389CE3CEC52C764

Function 00007FF7B88EE690 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7B88EE730
memcpy.MSVCRT ref: 00007FF7B88EE764

Strings

Result of , xrefs: 00007FF7B88EE692
basic_string::_M_create, xrefs: 00007FF7B88EE84A

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy
String ID: Result of $basic_string::_M_create
API String ID: 3510742995-1160149181
Opcode ID: b576b05e5929d0f36fddaa43a352fc9423e68f72584ed5aec93aa7cb1d61b280
Instruction ID: 48f197325ab64fe895bd921d12e11bba02ed8e223d36681de3f64f81ccde95b4
Opcode Fuzzy Hash: b576b05e5929d0f36fddaa43a352fc9423e68f72584ed5aec93aa7cb1d61b280
Instruction Fuzzy Hash: A8413826B1A69652EB21BA19844027AE351AB22BD9FD44933CF1C07B8CDF2CE413C324

Function 00007FF7B881A7AB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 209memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF7B881A8F3

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF7B881AA74
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B881AA96
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7B881AA8A

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 8fbf73ca66cf12792ec4443d84e4f446cfa418b5437152a325ab49fbedd29060
Instruction ID: 0a934b2caf6ab5de9118e822de127190f46cf213511479f5348d0d5dabae78cc
Opcode Fuzzy Hash: 8fbf73ca66cf12792ec4443d84e4f446cfa418b5437152a325ab49fbedd29060
Instruction Fuzzy Hash: 1F71D926F6951243EA20771CD540679E361AF7A7B4F948231CB2D17BDCDE2CE8638368

Function 00007FF7B881AB00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF7B881AB15

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction ID: ab82929384c68d686b40af2b673ba23911195f0c40cd869c557a2fdf9b1a4957
Opcode Fuzzy Hash: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction Fuzzy Hash: 5D215E60F2918247FA68726DD151338E1829FAF760F984935C71D863DDDD1CA8E3413D

Function 00007FF7B881A070 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B881A0F5
memcpy.MSVCRT ref: 00007FF7B881A10E
free.MSVCRT ref: 00007FF7B881A119

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction ID: 9c5d4cdfd26ad83e7099dba629c5e9ec85fa04a65d3d3fea2497901b9ffe0062
Opcode Fuzzy Hash: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction Fuzzy Hash: A331ED61A2964287F9627E19EA00379D2515F66BE0F988230DF5E87BCCDE3CD4534314

Function 00007FF7B880A8F8 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B880AA84

Strings

y, xrefs: 00007FF7B881482C
t, xrefs: 00007FF7B881480A
ty, xrefs: 00007FF7B880A9EE

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction ID: 9969eeaad12e045a87b017ed43eeb7b22423e61e7e0659d368b949abfa48d99c
Opcode Fuzzy Hash: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction Fuzzy Hash: 20E11D725087C2C6E7568F38C0143E87AA1EB2AF4CF4C8135CB990B799DBBE94959335

Function 00007FF7B880CC9C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880CD0C
strcmp.MSVCRT ref: 00007FF7B880CD49

Strings

(, xrefs: 00007FF7B8813FB5

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction ID: 94dabf9e697950c76e69a86c816919048374b30b2ab3230f57a4128bdee662db
Opcode Fuzzy Hash: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction Fuzzy Hash: A3A1A07261878682E715AF29C4043F9A7A1EB66F84F884032CF5E0B78ACF7DD495C364

Function 00007FF7B880BC30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B8810293

Strings

rm, xrefs: 00007FF7B8814EB6
a, xrefs: 00007FF7B8814EA2
a, xrefs: 00007FF7B8814E9D

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction ID: 9adbfd3911a9886e65eff134c8e9bb3d1b2a56ede65b5da16a9419f54562e62b
Opcode Fuzzy Hash: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction Fuzzy Hash: 7EB142725087C2C6E7569F28C0043E87A91EB2AF4CF5C8135CB890F799DFBE94569325

Function 00007FF7B88F5D20 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7B88F5DE6
memcpy.MSVCRT ref: 00007FF7B88F5E1E
memcpy.MSVCRT ref: 00007FF7B88F5E70

Strings

basic_string::_M_create, xrefs: 00007FF7B88F5EC7

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: a8466455f48f34cbcacbad28185616ab40d0001ae848e4642dd8ce78300a4c7c
Instruction ID: 16ddf591df137dba9e0276584d9fd0432a390f2a622047c018f498a4474854b3
Opcode Fuzzy Hash: a8466455f48f34cbcacbad28185616ab40d0001ae848e4642dd8ce78300a4c7c
Instruction Fuzzy Hash: 8961E562A26A4592EA15AB19C4042B9E391EF32BD4FC48B31DB1D437D8EF3CE463C314

Function 00007FF7B881FE10 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF7B881FF44

Part of subcall function 00007FF7B8826D60: ___lc_codepage_func.MSVCRT ref: 00007FF7B8826D7F

fputc.MSVCRT ref: 00007FF7B881FEB8

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ___lc_codepage_funcfputclocaleconv
String ID:
API String ID: 1339002523-0
Opcode ID: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction ID: 80d1493028db7d17207ab805f5678f7b4a451b6fcfd3f16cd66835cda06a12fe
Opcode Fuzzy Hash: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction Fuzzy Hash: 3D516073A255418AE720BF29D141369E7E1EB2AB58F944235EB0C4B38DCE28ED52C764

Function 00007FF7B88E9BF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7B88E9C7C
memcpy.MSVCRT ref: 00007FF7B88E9C99

Strings

basic_string::_M_replace, xrefs: 00007FF7B88E9D2D
basic_ios::clear, xrefs: 00007FF7B88E9BF4

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy
String ID: basic_ios::clear$basic_string::_M_replace
API String ID: 3510742995-1781676995
Opcode ID: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction ID: d2edbde710f519c517ed686d39aa3e68f79ce87071c00dd12bda330f47981643
Opcode Fuzzy Hash: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction Fuzzy Hash: 23310A21B2965582EA207B29D9046B8F6909B72BD5FD44233EF6C077DECD6CE013C358

Function 00007FF7B880C01B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880C086

Strings

, xrefs: 00007FF7B881422B
new , xrefs: 00007FF7B88141C2
: , xrefs: 00007FF7B880C0C9

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction ID: 5122e325eeb6711a9387a96b6b22c23d553d716c963f981806a41d3fcdacbead
Opcode Fuzzy Hash: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction Fuzzy Hash: FA41AF72B5474282E715BA1AE8003E9E751EBA7BD4F844032CF1E0B78ADE7CD492C364

Function 00007FF7B88BB7B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B88BB7D8
memcpy.MSVCRT ref: 00007FF7B88BB807

Strings

basic_string::_M_replace, xrefs: 00007FF7B88BB7B2, 00007FF7B88BB890
basic_string::_S_construct null not valid, xrefs: 00007FF7B88BB875

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_replace$basic_string::_S_construct null not valid
API String ID: 3412268980-2381965344
Opcode ID: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction ID: 000e5a0bd3517947a470c0c333af9d323ad2361a663f37fa9a6cfbae63cf668e
Opcode Fuzzy Hash: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction Fuzzy Hash: 2921D221A0AA4685EA11BB1EE4501ADE760AF66BC4FC44431EB4C0B369DE3CD463C354

Function 00007FF7B8802590 Relevance: 6.0, APIs: 4, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 00007FF7B88025BD
strcpy_s.MSVCRT ref: 00007FF7B88025CA
_strlwr.MSVCRT ref: 00007FF7B88025D6
_strlwr.MSVCRT ref: 00007FF7B88025DB

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: _strlwrstrcpy_s
String ID:
API String ID: 3746470816-0
Opcode ID: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction ID: e30748ed539c7d1e61d913905733a7fe04082f4356b91869a9333246b0a0132f
Opcode Fuzzy Hash: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction Fuzzy Hash: C6F0EC6131468686FE11AB23BD007A983099B96FC0F8C00328E4D17B98CC3CE2878308

Function 00007FF7B881A6B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7B881A64B
GetLastError.KERNEL32 ref: 00007FF7B881A6B8

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF7B881A6BE

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorLastQueryVirtual
String ID: VirtualProtect failed with code 0x%x
API String ID: 504369486-733738292
Opcode ID: 99177e9ec303cbc10e2a1adfcf84c78f0c9713cc82238b0c7c753296c4067b14
Instruction ID: 5bdd8885bd1d4e4b3df96b2896dcb3d8c6f1a469560240cd2d3a53a03d9948e1
Opcode Fuzzy Hash: 99177e9ec303cbc10e2a1adfcf84c78f0c9713cc82238b0c7c753296c4067b14
Instruction Fuzzy Hash: C7118272A1A64683EA11BB58E800968F394BF6AB54FC54234C71D07398EE3CE566C728

Function 00007FF7B881A420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

Unknown error, xrefs: 00007FF7B881A50C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction ID: 3f889e3ac87623ed78a611fc70f7d890d33ea12766c05bb439bdc7913b6e7a15
Opcode Fuzzy Hash: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction Fuzzy Hash: 9201E562919E84C2D202AF1CD8411FAF374FFAA75AF645321EB8C26264DF29D553C704

Function 00007FF7B881A4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Partial loss of significance (PLOSS), xrefs: 00007FF7B881A4D0

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction ID: f2432d1bf54d572cf9840d31791f9a7637f2d6232bfb5de2b3d4112598f149c7
Opcode Fuzzy Hash: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction Fuzzy Hash: 0EF0AF52819E8882D202AF1CA4000ABF324FF9E789F681325EB8D26168DF28E5438714

Function 00007FF7B881A4C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Argument domain error (DOMAIN), xrefs: 00007FF7B881A4C0

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction ID: a304c2a7c3383c22e66033ed15dbd16ddcbc8f45ac3130a88a2204468fde1acf
Opcode Fuzzy Hash: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction Fuzzy Hash: 12F0C252919E8882D202EF1CE4000EBF374FF9E789F681325EF8D26168DF28D5438714

Function 00007FF7B881A4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7B881A4F0

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction ID: 47c98e2b87dfd7b212ccef89f7740a3053a11abf697651173c76498833394039
Opcode Fuzzy Hash: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction Fuzzy Hash: A7F0AF52819E8482D202AF1CA4000ABF324FF9E789F681325EB8D26168DF28D5438714

Function 00007FF7B881A4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Overflow range error (OVERFLOW), xrefs: 00007FF7B881A4E0

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction ID: 991735c550df227ff58a0fe34e4c697c695971ed2343a7135e675d856cb5e6d2
Opcode Fuzzy Hash: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction Fuzzy Hash: 9FF0C256819E8882D202EF1CE4000EBF374FF9E789F681325EF8D26168DF28D5439714

Function 00007FF7B881A500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

Total loss of significance (TLOSS), xrefs: 00007FF7B881A500
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction ID: 7cbcaeb4c041705d94570af20f1bd40bc1cb4ab3b74e58ad93d5983b38a79c46
Opcode Fuzzy Hash: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction Fuzzy Hash: 1BF0AF52819E8482D202EF1CA8000ABF324FF9E799F681325EB8D26168DF28D5438714

Function 00007FF7B881A458 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Argument singularity (SIGN), xrefs: 00007FF7B881A458

Memory Dump Source

Source File: 00000000.00000002.1714965277.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000000.00000002.1714951537.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715040912.00007FF7B890D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715059386.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715152051.00007FF7B8AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715165795.00007FF7B8AA1000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1715181719.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction ID: d9414889897181edb48c86ac07903b5a4de699689b73277313565bf6fe0c4944
Opcode Fuzzy Hash: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction Fuzzy Hash: 72F06256915E8882D202EF1CA4000ABF364FF5E799F545325EF8D2A164DF28D5438714

Analysis Process: phantomtoolsv2.exePID: 7360, Parent PID: 7324COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 000000014007D6E0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000000014007D721
GetSystemMetrics.USER32 ref: 000000014007D72F
GetSystemMetrics.USER32 ref: 000000014007D73D
GetSystemMetrics.USER32 ref: 000000014007D74B
GetDC.USER32 ref: 000000014007D755
GetDeviceCaps.GDI32 ref: 000000014007D76B
GetDeviceCaps.GDI32 ref: 000000014007D77B
CreateCompatibleDC.GDI32 ref: 000000014007D788
CreateCompatibleBitmap.GDI32 ref: 000000014007D7A0
SelectObject.GDI32 ref: 000000014007D7B6
BitBlt.GDI32 ref: 000000014007D7EC
SHCreateMemStream.SHLWAPI ref: 000000014007D822
SelectObject.GDI32 ref: 000000014007D838
DeleteDC.GDI32 ref: 000000014007D841
ReleaseDC.USER32 ref: 000000014007D84C
DeleteObject.GDI32 ref: 000000014007D855
EnterCriticalSection.KERNEL32 ref: 000000014007D94C
LeaveCriticalSection.KERNEL32 ref: 000000014007D95E
IStream_Size.SHLWAPI ref: 000000014007D995
IStream_Reset.SHLWAPI ref: 000000014007D9A6
IStream_Read.SHLWAPI ref: 000000014007DA2B
SelectObject.GDI32 ref: 000000014007DA85
DeleteDC.GDI32 ref: 000000014007DA8E
ReleaseDC.USER32 ref: 000000014007DA9B
DeleteObject.GDI32 ref: 000000014007DAA4

Strings

, xrefs: 000000014007D7C1

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 10613e21fafc8436fd2f5221c2cf0da0956e339bc3aac913c20dfaf3faddebd0
Instruction ID: e3a4c5f85f79ae008f32d04c9c86629b48b84cda880ff6005115b69435b4f830
Opcode Fuzzy Hash: 10613e21fafc8436fd2f5221c2cf0da0956e339bc3aac913c20dfaf3faddebd0
Instruction Fuzzy Hash: 33B10C72218BC086E761DB22F85439EB7A5F799BC0F409615EA8E43B69DF3CC085CB10

Function 00000001400B67F0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400B689D
GetLastError.KERNEL32 ref: 00000001400B68A7
FindFirstFileW.KERNEL32 ref: 00000001400B68BE
GetLastError.KERNEL32 ref: 00000001400B68CA
FindClose.KERNEL32 ref: 00000001400B68D8
__std_fs_open_handle.LIBCPMT ref: 00000001400B696B
CloseHandle.KERNEL32 ref: 00000001400B6981
CloseHandle.KERNEL32 ref: 00000001400B6AF4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: d85f8055f170a3e42cc2abc3b6e60dcf62aaf909d48f3642368a07fec51f6fb2
Instruction ID: f30b710bc0a933ac4d5384297774a0afb11e9a7f35cb4894955e283119ac2b15
Opcode Fuzzy Hash: d85f8055f170a3e42cc2abc3b6e60dcf62aaf909d48f3642368a07fec51f6fb2
Instruction Fuzzy Hash: 9A915F32700E4146EA768FA7A8147AA27A4EB8D7F4F184725BBBA477F4DB3CC4458701

Function 000000014007F210 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 000000014007F540

Strings

timezone, xrefs: 0000000140080FC4
ram, xrefs: 000000014008040B
computer_name, xrefs: 0000000140080504
cpu, xrefs: 00000001400801C8
system, xrefs: 000000014007FF94, 0000000140080083, 0000000140080179, 0000000140080273, 00000001400803BB, 00000001400804B5, 00000001400805A8, 000000014008072F, 0000000140080920, 0000000140080BA1, 0000000140080D64, 0000000140080F7E, 000000014008111D, 00000001400812C7, 000000014008138D
user_name, xrefs: 000000014007FFDF
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140080B0F
[UTC, xrefs: 000000014007F513
time, xrefs: 0000000140080BF1
gpu, xrefs: 00000001400800D2

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: db8b9a328984e2e15845eb184bc761b3fd5f1a319e063fc82474756fa5033a3d
Instruction ID: d8a4adb988cae47952a421a4533d33faa55453df35c4720b85b424b72054d796
Opcode Fuzzy Hash: db8b9a328984e2e15845eb184bc761b3fd5f1a319e063fc82474756fa5033a3d
Instruction Fuzzy Hash: 37237C73614BC485EB22CB66E8403DE77A1F799798F405216FB9D17BA9EB78C290C700

Function 000000014007FBA0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 000000014007E7E0: GetCurrentHwProfileW.ADVAPI32 ref: 000000014007E81C

Part of subcall function 000000014007E0B0: EnumDisplayDevicesW.USER32 ref: 000000014007E1C7
Part of subcall function 000000014007E0B0: EnumDisplayDevicesW.USER32 ref: 000000014007E26B

Part of subcall function 000000014007DFD0: RegGetValueA.ADVAPI32 ref: 000000014007E039

Part of subcall function 000000014007DCC0: GetUserNameW.ADVAPI32 ref: 000000014007DD05

Part of subcall function 000000014007DD60: GetComputerNameW.KERNEL32 ref: 000000014007DDA5

GlobalMemoryStatusEx.KERNEL32 ref: 000000014008032C
wcsftime.LIBCMT ref: 0000000140080B22
GetModuleFileNameA.KERNEL32 ref: 0000000140080CB6

Strings

timezone, xrefs: 0000000140080FC4
ram, xrefs: 000000014008040B
computer_name, xrefs: 0000000140080504
cpu, xrefs: 00000001400801C8
system, xrefs: 000000014007FF94, 0000000140080083, 0000000140080179, 0000000140080273, 00000001400803BB, 00000001400804B5, 00000001400805A8, 000000014008072F, 0000000140080920, 0000000140080BA1, 0000000140080D64, 0000000140080F7E, 000000014008111D, 00000001400812C7, 000000014008138D
user_name, xrefs: 000000014007FFDF
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140080B0F
time, xrefs: 0000000140080BF1
gpu, xrefs: 00000001400800D2

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: 58b1eb6f823cc91818667243d049fc5d6c5a301e581f7608c6d430d17837e0db
Instruction ID: 49d42806534426b2957efd760b35444bd4990644153d0c1b518906e600f5a260
Opcode Fuzzy Hash: 58b1eb6f823cc91818667243d049fc5d6c5a301e581f7608c6d430d17837e0db
Instruction Fuzzy Hash: DEF26E73614BC485DB22CF66E8903DE77A1F799798F409216EB9D17BA9DB38C290C700

Function 000000014003B740 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003B82C
GetProcAddress.KERNEL32 ref: 000000014003B937
GetProcAddress.KERNEL32 ref: 000000014003B9F9
GetProcAddress.KERNEL32 ref: 000000014003BA73
GetProcAddress.KERNEL32 ref: 000000014003BAF5
GetProcAddress.KERNEL32 ref: 000000014003BB6F
GetProcAddress.KERNEL32 ref: 000000014003BBF3
FreeLibrary.KERNEL32 ref: 000000014003C721

Strings

system, xrefs: 000000014003C52D
vault, xrefs: 000000014003C583
cannot use push_back() with , xrefs: 000000014003C76F

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: cf1552e1b7d9117c1af13d953b0fa66b1776464e6f3090e5b78dac3b4abb2142
Instruction ID: e238341b761cbd504de5d878f5a533d9cd629839bec99a3b7c40a5bfdf261a8f
Opcode Fuzzy Hash: cf1552e1b7d9117c1af13d953b0fa66b1776464e6f3090e5b78dac3b4abb2142
Instruction Fuzzy Hash: 74925E32215BC489DB62CF66E8843DE73A0F749798F504216EB9C5BBA9EF74C694C700

Function 000000014007CDF0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 379
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000000014007D017

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

InternetOpenUrlA.WININET ref: 000000014007D088
HttpQueryInfoW.WININET ref: 000000014007D0E0
HttpQueryInfoW.WININET ref: 000000014007D170
InternetQueryDataAvailable.WININET ref: 000000014007D1B4
InternetReadFile.WININET ref: 000000014007D279
InternetQueryDataAvailable.WININET ref: 000000014007D344
InternetCloseHandle.WININET ref: 000000014007D3EE
Concurrency::cancel_current_task.LIBCPMT ref: 000000014007D42F

Strings

0Q>%&&, xrefs: 000000014007CECF

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$AcquireCloseConcurrency::cancel_current_taskExclusiveFileHandleLockRead
String ID: 0Q>%&&
API String ID: 3609429561-3488671784
Opcode ID: 57ca7581aa671b4f5e8d6bcb6210d21ab16385bc4098e479ac351e805d702d63
Instruction ID: 545cd8f60b377f538693443bd994a67682f78e99984eccf18132968f8f5fa667
Opcode Fuzzy Hash: 57ca7581aa671b4f5e8d6bcb6210d21ab16385bc4098e479ac351e805d702d63
Instruction Fuzzy Hash: 56024B32A14B9486EB11CB6AE84039E77B5F799B94F104216FF8C57BA9DF78C191CB00

Function 00000001400740C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400773A0: GetCurrentProcess.KERNEL32 ref: 00000001400773DB
Part of subcall function 00000001400773A0: OpenProcessToken.ADVAPI32 ref: 00000001400773EE
Part of subcall function 00000001400773A0: GetTokenInformation.ADVAPI32 ref: 000000014007742A
Part of subcall function 00000001400773A0: CloseHandle.KERNEL32 ref: 000000014007744B

ExitProcess.KERNEL32 ref: 0000000140074107
OpenMutexA.KERNEL32 ref: 0000000140074222
ExitProcess.KERNEL32 ref: 0000000140074232
CreateMutexA.KERNEL32 ref: 0000000140074251
ExitProcess.KERNEL32 ref: 0000000140074277

Part of subcall function 00000001400776E0: GetModuleFileNameW.KERNEL32 ref: 000000014007772A

Part of subcall function 0000000140082380: CoInitializeEx.OLE32 ref: 00000001400823EA

Strings

SeDebugPrivilege, xrefs: 000000014007410E
SeImpersonatePrivilege, xrefs: 000000014007411A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: 22102685a5f7e279fe00576c66398d0ccc8d38b604ca0999720ef11f553e0a09
Instruction ID: 0dce43155375b8d528c185d9e4ebfb7a595039168db3da0343ae86ac4b3ee73c
Opcode Fuzzy Hash: 22102685a5f7e279fe00576c66398d0ccc8d38b604ca0999720ef11f553e0a09
Instruction Fuzzy Hash: 02617D32618A8481FB22AB66B4553EEA350FB8D7D0F405215FB8D47AFBDF3CC1458610

Function 000000014009DFA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000000014009DFE5

Part of subcall function 000000014009D650: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D664

Part of subcall function 0000000140098C40: HeapFree.KERNEL32 ref: 0000000140098C56
Part of subcall function 0000000140098C40: GetLastError.KERNEL32 ref: 0000000140098C60

Part of subcall function 00000001400A69C0: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A690B

_get_daylight.LIBCMT ref: 000000014009DFD4

Part of subcall function 000000014009D6B0: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D6C4

_get_daylight.LIBCMT ref: 000000014009E24A
_get_daylight.LIBCMT ref: 000000014009E25B
_get_daylight.LIBCMT ref: 000000014009E26C
GetTimeZoneInformation.KERNEL32 ref: 000000014009E293

Strings

Eastern Standard Time, xrefs: 000000014009E339
Eastern Summer Time, xrefs: 000000014009E351

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 64857797be4b4bc743e53f8277ad21999e71f22f2571a5a646b81b6a6c0c373e
Instruction ID: 57a15796427d9fcb09a0dbe4420b896af4f059e924f9dcb49e1fee42cb9384cd
Opcode Fuzzy Hash: 64857797be4b4bc743e53f8277ad21999e71f22f2571a5a646b81b6a6c0c373e
Instruction Fuzzy Hash: 6AD1A13660069086EB26EF27D9913EA77A1F79CBD4F448126FF49477A5EB38C881C740

Function 0000000140076BA0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 0000000140076DE1
SetFilePointer.KERNEL32 ref: 0000000140076E94
ReadFile.KERNEL32 ref: 0000000140076EC3

Strings

ios_base::eofbit set, xrefs: 0000000140077304
exists, xrefs: 000000014007734A
ios_base::failbit set, xrefs: 00000001400772FD
ios_base::badbit set, xrefs: 00000001400772F1, 000000014007736F

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 2dee09089020d12bff93b15070664e9e72d6829c04d3fceb49d3c96b73ffa313
Instruction ID: 40f04f2fdb195ee4abd318aa1af1c765dbd1d036b26c427fa27dbe08016d783e
Opcode Fuzzy Hash: 2dee09089020d12bff93b15070664e9e72d6829c04d3fceb49d3c96b73ffa313
Instruction Fuzzy Hash: 61320732611BC489EB22CF35D8807DD37A1F789B88F548216EB8D5BBA9EB74C645C701

Function 000000014009ACF0 Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009B122

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a4e148d3019c607eba337c575eb47066f6d9809a4559c3d9a9662e58cd0a8e9b
Instruction ID: a61a03662d1ceb98f773c1fd4dd386c3faedb153c1a554d0ed1fc3a7b0e16e44
Opcode Fuzzy Hash: a4e148d3019c607eba337c575eb47066f6d9809a4559c3d9a9662e58cd0a8e9b
Instruction Fuzzy Hash: 0AC1ED722046889AEB639B63D4503EE77A0F78ABD4F454115FB5A073F2DB78C894C740

Function 000000014009E21C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 000000014009E24A

Part of subcall function 000000014009D6B0: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D6C4

_get_daylight.LIBCMT ref: 000000014009E25B

Part of subcall function 000000014009D650: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D664

_get_daylight.LIBCMT ref: 000000014009E26C

Part of subcall function 000000014009D680: _invalid_parameter_noinfo.LIBCMT ref: 000000014009D694

Part of subcall function 0000000140098C40: HeapFree.KERNEL32 ref: 0000000140098C56
Part of subcall function 0000000140098C40: GetLastError.KERNEL32 ref: 0000000140098C60

GetTimeZoneInformation.KERNEL32 ref: 000000014009E293

Strings

Eastern Standard Time, xrefs: 000000014009E339
Eastern Summer Time, xrefs: 000000014009E351

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d74fe9053881973c1ea53b30896d127691720d56f467a61c309a8fd480ec90bc
Instruction ID: 54eaaf3237c51ac38e9593f75949bc1a28ba80c68989b2b5926f1269b82db785
Opcode Fuzzy Hash: d74fe9053881973c1ea53b30896d127691720d56f467a61c309a8fd480ec90bc
Instruction Fuzzy Hash: B5514D3261068086E762EF23E9917DA77A0F79CBC4F445126BB4D87BB6DB38C941C740

Function 0000000140086680 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086834
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086842
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086AC5
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140086AD3

Strings

value, xrefs: 000000014008675A, 00000001400869F3

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: b171d2323bf2893a3ee67810772fca15aef2c8ea295963dbb2e0401c6901666c
Instruction ID: b99257adfc3fe72b1b6041d942e319ffdfc58320064849e92109cd12b73f12f2
Opcode Fuzzy Hash: b171d2323bf2893a3ee67810772fca15aef2c8ea295963dbb2e0401c6901666c
Instruction Fuzzy Hash: 39027973624B8085EB128B76D4803ED6B61F7997E4F505712FBAE47AEADB38C185C700

Function 000000014003C7E0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C82A
Process32FirstW.KERNEL32 ref: 000000014003C86C
Process32NextW.KERNEL32 ref: 000000014003CA63
CloseHandle.KERNEL32 ref: 000000014003CCDA

Strings

[PID: , xrefs: 000000014003C8AE

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 29bff462b9a0cd84f036986d1846429dd02910c6ec44a41ca48570137e3960ba
Instruction ID: b38ff16549ba1f11a6e6968b632c4904c7fd50b9942315672275084aeb0ad256
Opcode Fuzzy Hash: 29bff462b9a0cd84f036986d1846429dd02910c6ec44a41ca48570137e3960ba
Instruction Fuzzy Hash: 61E18C72614BC485EB22CB26E8803DE77A5F7897A8F504215FB9D47BA9DF38C291C700

Function 00000001400835B0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400835FE
OpenProcessToken.ADVAPI32 ref: 0000000140083611
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140083632
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140083678
CloseHandle.KERNEL32 ref: 0000000140083698

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29403cb97127691f287bd394a5f62fb3ebcddb21656a1aa952221290d0b63ec9
Instruction ID: 29b34f3b368a7b7b08dc0a61096efbdd798a7df5e1e9600c8704bf8681a41008
Opcode Fuzzy Hash: 29403cb97127691f287bd394a5f62fb3ebcddb21656a1aa952221290d0b63ec9
Instruction Fuzzy Hash: 92214B32218B8096E7618B22F44439AB7A0FB8CBD0F559126FB8947B68DF7DC5558B40

Function 000000014007C5E0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014007C7BC
recv.WS2_32 ref: 000000014007CC9C
closesocket.WS2_32 ref: 000000014007CCAE
WSACleanup.WS2_32 ref: 000000014007CCB4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 1cb9a2f55eb7a1731417e4445776eee7ddd9fd51caeb430b5848111ad9bfac1a
Instruction ID: eafd79885a64c3900f7ebaffd470ce8fdc6633dcc422e553d72d048b7a611f0d
Opcode Fuzzy Hash: 1cb9a2f55eb7a1731417e4445776eee7ddd9fd51caeb430b5848111ad9bfac1a
Instruction Fuzzy Hash: 79125D73628BC481EA229B16E4557DE6761F79D7E0F504216EBAD07AEADF7CC480CB00

Function 000000014003ABE0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003AC42
CredFree.ADVAPI32 ref: 000000014003B666

Strings

cannot use push_back() with , xrefs: 000000014003B6B4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 5d5e629679f06e378ab227d13d1c908ce7cae262931ff94a6b5bddadf6b7fee5
Instruction ID: b8981478b51ca5d0890c2abb008d1f65ae76408375637bccaff58bdcf3fe8ba2
Opcode Fuzzy Hash: 5d5e629679f06e378ab227d13d1c908ce7cae262931ff94a6b5bddadf6b7fee5
Instruction Fuzzy Hash: A5627172614BC489EB22CF65E8803DE7761F789798F505316EB9D17BA9DB38C284C700

Function 00000001400743A0 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0000000140074403
ShellExecuteW.SHELL32 ref: 0000000140074A4A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: c5c4df2ba0c2f7c98eb0e27f9d344fa7fbd7b5d8e88954d453f4da2353b8da7d
Instruction ID: 2bd182f3932b21625a389bd3f9c8cb9026c7739f8b6ceac0e40a61b3b544c7b5
Opcode Fuzzy Hash: c5c4df2ba0c2f7c98eb0e27f9d344fa7fbd7b5d8e88954d453f4da2353b8da7d
Instruction Fuzzy Hash: E1122872625F848AEB418F6AE88179EB3A4F788798F505215FFDD57B68EB38C150C700

Function 000000014006FB80 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000000014006FBD8
LocalFree.KERNEL32 ref: 000000014006FC6A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 7c7574550fc39d8b0a33bde6b28a20e688f0cf8f24e77118c322436bf9816072
Instruction ID: 4eca3d6246eddbc7233f6218ad4025bd3c7ad5f366a7b9f67c01a1a686e41648
Opcode Fuzzy Hash: 7c7574550fc39d8b0a33bde6b28a20e688f0cf8f24e77118c322436bf9816072
Instruction Fuzzy Hash: 08414233614B80CAE3218F75E8403ED37A5F76978CF444629AB8C07E9ADB79C6A4D744

Function 000000014007EF60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 000000014007EFD1

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 2ecfcf8ec3355e95828c5702cb0626b7e0f13828b402b7b66e3bb95fa858c4cc
Instruction ID: 7bd9b24b1647809e0778951e81701b119688313c090f26668272845d8869c3c0
Opcode Fuzzy Hash: 2ecfcf8ec3355e95828c5702cb0626b7e0f13828b402b7b66e3bb95fa858c4cc
Instruction Fuzzy Hash: 8A416D33A18B8086E711CF25E8803DEB774F799788F505216EB8823A79DB78D5D1DB40

Function 000000014007DCC0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 000000014007DD05

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a200866481d5f490145c7cfb544eaa6f59862c73f3fa110e9056edbadfc7f145
Instruction ID: d8acf5b1ef26c196afcc54b854055169309763f983814a9c25a6fac2079a55ec
Opcode Fuzzy Hash: a200866481d5f490145c7cfb544eaa6f59862c73f3fa110e9056edbadfc7f145
Instruction Fuzzy Hash: BB015E3221878086E7628F22E84039AB3A0FB9C788F540216B78D43659DBBCC194CB40

Function 0000000140076770 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400764F0: InitializeCriticalSectionEx.KERNEL32 ref: 0000000140076541
Part of subcall function 00000001400764F0: GetLastError.KERNEL32 ref: 000000014007654B

EnterCriticalSection.KERNEL32 ref: 00000001400767B1
GdiplusStartup.GDIPLUS ref: 00000001400767D8
LeaveCriticalSection.KERNEL32 ref: 00000001400767E6
LeaveCriticalSection.KERNEL32 ref: 0000000140076814
GdipGetImageEncodersSize.GDIPLUS ref: 0000000140076822
GdipGetImageEncoders.GDIPLUS ref: 00000001400768B6
GdipCreateBitmapFromScan0.GDIPLUS ref: 0000000140076980
GdipSaveImageToStream.GDIPLUS ref: 000000014007699E
GdipDisposeImage.GDIPLUS ref: 0000000140076A03
GdipDisposeImage.GDIPLUS ref: 0000000140076A17

Strings

&, xrefs: 000000014007697A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: ea4cfa494391b84614adf15e569615d49e1d486304e7799aebd586ce4898f67b
Instruction ID: 4638b9f1ed191ead81af55374984443a6253b3e001763369ab5e9b0db0011ef1
Opcode Fuzzy Hash: ea4cfa494391b84614adf15e569615d49e1d486304e7799aebd586ce4898f67b
Instruction Fuzzy Hash: 84914932200B809AEB62DF32E8407D837A4F75DBD8F558215EB5A57BA4DF38C596C740

Function 0000000140077820 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 224
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007D440: GetUserGeoID.KERNEL32 ref: 000000014007D467
Part of subcall function 000000014007D440: GetGeoInfoA.KERNEL32 ref: 000000014007D481
Part of subcall function 000000014007D440: GetGeoInfoA.KERNEL32 ref: 000000014007D4D1

WSAStartup.WS2_32 ref: 0000000140077999
socket.WS2_32 ref: 00000001400779B6
htons.WS2_32 ref: 00000001400779D7
inet_pton.WS2_32 ref: 0000000140077A04
connect.WS2_32 ref: 0000000140077A1E
closesocket.WS2_32 ref: 0000000140077A34
WSACleanup.WS2_32 ref: 0000000140077A3A

Part of subcall function 0000000140076A50: SHGetKnownFolderPath.SHELL32 ref: 0000000140076AA9
Part of subcall function 0000000140076A50: CoTaskMemFree.OLE32 ref: 0000000140076B6A

Strings

system, xrefs: 0000000140077905
geo, xrefs: 0000000140077946

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Info$CleanupFolderFreeKnownPathStartupTaskUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 469733038-2364779556
Opcode ID: 8d373b034231c228b96861fcc9ebfa537825f0b970b577bdf6468f570e4dfbe5
Instruction ID: 8e9467e575cce1f4fcad52bc0cce26140f8a2cb03e3f0a27ea38b4210fb68b06
Opcode Fuzzy Hash: 8d373b034231c228b96861fcc9ebfa537825f0b970b577bdf6468f570e4dfbe5
Instruction Fuzzy Hash: 44B16A72B11B4099FB02DBA6E4903DD3372A748BE8F415216EB5D2B6B9EB38C556C340

Function 00000001400BC218 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBE39
Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBEB9
Part of subcall function 00000001400BBDF8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BBF0D
Part of subcall function 00000001400BBDF8: _get_daylight.LIBCMT ref: 00000001400BBF65

CreateFileW.KERNEL32 ref: 00000001400BC31E
CreateFileW.KERNEL32 ref: 00000001400BC36E
GetLastError.KERNEL32 ref: 00000001400BC39E
GetFileType.KERNEL32 ref: 00000001400BC3B3
GetLastError.KERNEL32 ref: 00000001400BC3BD
CloseHandle.KERNEL32 ref: 00000001400BC3F0
CloseHandle.KERNEL32 ref: 00000001400BC554
CreateFileW.KERNEL32 ref: 00000001400BC589
GetLastError.KERNEL32 ref: 00000001400BC598

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 6834bf7e2c5a4e43a5153222154aa821744e12b776a4e5df19d1db0543b86cff
Instruction ID: 2400ce5abb7f630c19717e6ed24876b630cbd6c53283576e13b355a578458c61
Opcode Fuzzy Hash: 6834bf7e2c5a4e43a5153222154aa821744e12b776a4e5df19d1db0543b86cff
Instruction Fuzzy Hash: 29C17B36720E4486EB11CFAAD4917ED3771E78DBE8F014219EB2A9B7A4DB34C556C340

Function 00000001400816E0 Relevance: 13.6, APIs: 9, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140081744
GetProcessId.KERNEL32 ref: 000000014008174D
RmStartSession.RSTRTMGR ref: 000000014008177C
RmRegisterResources.RSTRTMGR ref: 00000001400817A7
RmGetList.RSTRTMGR ref: 00000001400817E0
RmGetList.RSTRTMGR ref: 0000000140081842
RmEndSession.RSTRTMGR ref: 000000014008188B

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

RmEndSession.RSTRTMGR ref: 00000001400818C3
RmEndSession.RSTRTMGR ref: 00000001400818D8

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Session$ListProcess$AcquireCurrentExclusiveLockRegisterResourcesStart
String ID:
API String ID: 779856957-0
Opcode ID: 8bb7912290508ce8e88e3aaa07301283af1f89745b5405751b14ca5c1f9e5710
Instruction ID: 53b25bd5857afa0adccecd5323b097c20916bf7b3c0f165211610be25f83b61c
Opcode Fuzzy Hash: 8bb7912290508ce8e88e3aaa07301283af1f89745b5405751b14ca5c1f9e5710
Instruction Fuzzy Hash: 1251EA32B04A408AF715DFA6E4547ED73B5FB8C794F804529EB0A63BA8DE34C946CB50

Function 00000001400765D0 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 0000000140076613
EnterCriticalSection.KERNEL32 ref: 0000000140076625
EnterCriticalSection.KERNEL32 ref: 0000000140076635
GdiplusShutdown.GDIPLUS ref: 0000000140076643
LeaveCriticalSection.KERNEL32 ref: 0000000140076650
LeaveCriticalSection.KERNEL32 ref: 000000014007665A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: d30fa97d25b30040903c896763b34352f449627e961995d8f8dec80d22df3c23
Instruction ID: 8a8879636937726213d256da63e2acee3874314be20df8b71bbfc014c3c2afad
Opcode Fuzzy Hash: d30fa97d25b30040903c896763b34352f449627e961995d8f8dec80d22df3c23
Instruction Fuzzy Hash: 4911F532112B5081EB559F26F89439D73A4FB48FA8F684215EB6E076B4DF38C9A7C350

Function 00000001400773A0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400773DB
OpenProcessToken.ADVAPI32 ref: 00000001400773EE
GetTokenInformation.ADVAPI32 ref: 000000014007742A
CloseHandle.KERNEL32 ref: 000000014007744B

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: ef49ddb1ddd7164590c42208bf10f4cc77ba0bfa614ad2019f69ccc4385f50ed
Instruction ID: 18b2a2583657b35ee9209c3dde09c8a115d2f9d62867d95ebc4690e525d54a35
Opcode Fuzzy Hash: ef49ddb1ddd7164590c42208bf10f4cc77ba0bfa614ad2019f69ccc4385f50ed
Instruction Fuzzy Hash: B611E932219B8086E7519F16F84078AB7A0FB89BC0F949126FB9D57B68CF3CC456CB40

Function 000000014007DFD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 000000014007E039

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000000014007E02B
ProductName, xrefs: 000000014007E024

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 576cd30aba55f3842207aa2485d313445215fb856a716db7fe162e5e19891f38
Instruction ID: a4b0ef12f94d62d88fbacb8910d1321fab3fd413e5af6e1630ae25f216ec36bd
Opcode Fuzzy Hash: 576cd30aba55f3842207aa2485d313445215fb856a716db7fe162e5e19891f38
Instruction Fuzzy Hash: 8D112132618B8086EB218F22F44139AB3A4F79DB94F504215EB9847B69DFBCC195CB40

Function 000000014007C967 Relevance: 4.7, APIs: 3, Instructions: 182networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014007CC9C
closesocket.WS2_32 ref: 000000014007CCAE
WSACleanup.WS2_32 ref: 000000014007CCB4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: c5f29a6f82e4cda5efd12a128531453d2ae7e63ca47262aae0ccc1e1a6d6ada8
Instruction ID: eab709b2a91d71219dc338bdc8a0427637c2479730885535d0f181a11fd59591
Opcode Fuzzy Hash: c5f29a6f82e4cda5efd12a128531453d2ae7e63ca47262aae0ccc1e1a6d6ada8
Instruction Fuzzy Hash: 4D917CB3A14BC481EA228B66E4447DE6761E7997E0F504316EBAD17AEADF7CC480C700

Function 000000014007ECC1 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007ECD9
RegEnumKeyExA.ADVAPI32 ref: 000000014007ED1E
RegCloseKey.ADVAPI32 ref: 000000014007EF14

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 24e3e45b33dee53dd91fe293e1ba6f2dd892832e98d2f12ab480f34579417cf4
Instruction ID: 00c63e96622fe58056b134ab382f664d7db465f44603d43fd8bfb30478044826
Opcode Fuzzy Hash: 24e3e45b33dee53dd91fe293e1ba6f2dd892832e98d2f12ab480f34579417cf4
Instruction Fuzzy Hash: D5717E72A04B8485EB21CB6AE44439EB761F7997E8F104316FBA917AE9DB78C1C1C700

Function 000000014007EC50 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007ECD9
RegEnumKeyExA.ADVAPI32 ref: 000000014007ED1E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: dc2a33b660cd6048a5e7e075a00a4d1af131d9557838307254cbb15d219bc776
Instruction ID: d99dd46795cba76a18b6d2adc5ebc249d08e68adb2bc3dba870c2fbf3ce0d704
Opcode Fuzzy Hash: dc2a33b660cd6048a5e7e075a00a4d1af131d9557838307254cbb15d219bc776
Instruction Fuzzy Hash: 2331AD32611B8486E722CFA2E850B9E7764F7887D8F600216EF9917BA4DF38C592C700

Function 000000014007E98B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007E9A7
RegQueryValueExA.ADVAPI32 ref: 000000014007E9E6
RegCloseKey.ADVAPI32 ref: 000000014007EA84

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 086936de3dea8a6f787c3973e262829973f2fb37e82d8b4b8157a7a5627c85f4
Instruction ID: c3e250c8b4c2848e291f8a15b8f2a07f81789114fb1aa71ab368e6c187887dba
Opcode Fuzzy Hash: 086936de3dea8a6f787c3973e262829973f2fb37e82d8b4b8157a7a5627c85f4
Instruction Fuzzy Hash: 23218172715B8491EA62CB26E4503AEA760FBDD7D4F505212FB8D43AB9EE3CD184CB40

Function 000000014007D440 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000000014007D467
GetGeoInfoA.KERNEL32 ref: 000000014007D481
GetGeoInfoA.KERNEL32 ref: 000000014007D4D1

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: dabddd6c895e2f52a57a7818505f9d76ff45043fc459ccda3d8ac0e690d592da
Instruction ID: 90fee48f990a536c98e20aba751c2c9c04ba674589e67a0b677829bb88304ab3
Opcode Fuzzy Hash: dabddd6c895e2f52a57a7818505f9d76ff45043fc459ccda3d8ac0e690d592da
Instruction Fuzzy Hash: A211C17261478183E7118F62F42475EB7A1FB84FC8F045225EB8903B69DF7CD4908B84

Function 000000014003F210 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003F3FC

Strings

, xrefs: 000000014003F293

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-3916222277
Opcode ID: d1a363919dd19d68adbaa1824478dd39cb0e0911c99aa75ce560a6b8aa69075f
Instruction ID: a981a205836d7b9725245c82c35ce7c20dd13c8e2bec3eb01c485d5cb054b2d7
Opcode Fuzzy Hash: d1a363919dd19d68adbaa1824478dd39cb0e0911c99aa75ce560a6b8aa69075f
Instruction Fuzzy Hash: 52513472304B4496EB168F2AD5943AE37A0F748BD4F984622EF5E47BA0CF78D5A1D300

Function 0000000140045670 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400457CB

Strings

cannot use operator[] with a numeric argument with , xrefs: 0000000140045B99

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 79804f4a44a177bf13a4b8f88762019dc26778b0f8d53fd89d330793441b4ef7
Instruction ID: 5ed39cd970f3da3471a7114cda8519d5d7bf48897c2ee1ddb565b91127a7abb1
Opcode Fuzzy Hash: 79804f4a44a177bf13a4b8f88762019dc26778b0f8d53fd89d330793441b4ef7
Instruction Fuzzy Hash: C731D272319B8085EE12AB27B5443DC6396E708BE5F590635FF6D0BBE6DA38C481C304

Function 000000014007E7E0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 000000014007E81C

Strings

Unknown, xrefs: 000000014007E8D6

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 84af72ff015fe5e630872b959f4c077e317d5b2c424c6600391211d0d1ad29ad
Instruction ID: 2df4d503fb94b901bbb3591b6d9df59f6543af604a458be958b3d62f3549f16d
Opcode Fuzzy Hash: 84af72ff015fe5e630872b959f4c077e317d5b2c424c6600391211d0d1ad29ad
Instruction Fuzzy Hash: 01319E33628BC086E7528F22E5403DAA760F7DDB84F546215FBC917A6ADB7CC695CB00

Function 0000000140076A50 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000000140076AA9
CoTaskMemFree.OLE32 ref: 0000000140076B6A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 796d1de632755f28a7586c5e198064a8ea904def8bbd7f9ebb2a2b0b110e21d4
Instruction ID: 08cddd457017ed9c72ba9d518141911ad73ee79bdddd2d4fd5b26cada53b40a9
Opcode Fuzzy Hash: 796d1de632755f28a7586c5e198064a8ea904def8bbd7f9ebb2a2b0b110e21d4
Instruction Fuzzy Hash: 73319372A14B8081E6218F26E48039EB360F79D7F4F505316FBAD43AA9DB7CC1818B40

Function 000000014008C104 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C12B

Part of subcall function 000000014008C0C0: _invalid_parameter_noinfo.LIBCMT ref: 000000014008C0D7

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C1D8

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 75dacb89e764ecf40af59fcee7c22e2fbf6e8ba84ae5c27b2747cb5a966399e9
Instruction ID: 8be8243372e4bb7338c400875aec30a5fe64968161bb492a5739d17ce4fc8c58
Opcode Fuzzy Hash: 75dacb89e764ecf40af59fcee7c22e2fbf6e8ba84ae5c27b2747cb5a966399e9
Instruction Fuzzy Hash: 40217C3362064481EE56EB16E895BE93361F79ABD4F944216FB1A473F2EA39C259C300

Function 0000000140074FD0 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140075021
RegCloseKey.ADVAPI32 ref: 0000000140075033

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 7ec879cfecc611e1203277112fd56f06e17ca4e10c092f3590478b68c26c49ef
Instruction ID: ec14ba0587e031e24ade476592ff76ecaadcb2d768a7e792e5b1a87d2e94dd26
Opcode Fuzzy Hash: 7ec879cfecc611e1203277112fd56f06e17ca4e10c092f3590478b68c26c49ef
Instruction Fuzzy Hash: 35219F72711A8046FA51AB23E8503DAA360EB9DBD4F585121FB4D43BA9DE7CC481C780

Function 000000014007428C Relevance: 3.1, APIs: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003C7E0: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C82A
Part of subcall function 000000014003C7E0: Process32FirstW.KERNEL32 ref: 000000014003C86C

Part of subcall function 000000014003ABE0: CredEnumerateA.ADVAPI32 ref: 000000014003AC42

Part of subcall function 000000014007C5E0: recv.WS2_32 ref: 000000014007C7BC

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 1e475a0fd37e72c571760871dcb9f9096f5c0b73a05df945e32f443ddcc6d7f4
Instruction ID: 7b9fc5bf202d6c660958987423c1e07503b58d6b0919fc9b46d6a515e610c1ca
Opcode Fuzzy Hash: 1e475a0fd37e72c571760871dcb9f9096f5c0b73a05df945e32f443ddcc6d7f4
Instruction Fuzzy Hash: 96215871A5468081FB23BBB7A4163EE6351AF8E7D0F445612FB99476F7DF3C80818622

Function 00000001400742BD Relevance: 3.0, APIs: 2, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C5E0: recv.WS2_32 ref: 000000014007C7BC

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 688f010fb93d99a7170d6fa059f594efe689c9c1b67f65fa2a329f1f928e5df2
Instruction ID: 6f94cae61cdad2189cef370b3ba5221df8fa11a5c37ea0c6658456750868d446
Opcode Fuzzy Hash: 688f010fb93d99a7170d6fa059f594efe689c9c1b67f65fa2a329f1f928e5df2
Instruction Fuzzy Hash: 14111871A1468181FB637B77A4063EE5250AB8E7D0F445611FB99476F7DF3CC1818611

Function 000000014009B264 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000000014009B2B0
GetLastError.KERNEL32 ref: 000000014009B2BA

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 74fd80307102959cdb4bb45340283f0b27aee8fd65d2f6709d6669cbca38fe3f
Instruction ID: e816577ed0fe5e9188ac3a7553593d5145fada9baf7cdf4296f147d26e6d8956
Opcode Fuzzy Hash: 74fd80307102959cdb4bb45340283f0b27aee8fd65d2f6709d6669cbca38fe3f
Instruction Fuzzy Hash: EE119E72314B8081EA518B26AA4439EA761E789FF4F544315FFB94B7F9CF78C0558740

Function 00000001400742E9 Relevance: 3.0, APIs: 2, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00000001400742FB
CloseHandle.KERNEL32 ref: 0000000140074304

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: 96d4f6a17b3e9df86ae38d560ee459ed41c223e123a4abdd348c551b97df98bf
Instruction ID: 4df68b0ff96a1f532fb189d16ae1a04ce7a62c23901e90ecebd86e927d313f56
Opcode Fuzzy Hash: 96d4f6a17b3e9df86ae38d560ee459ed41c223e123a4abdd348c551b97df98bf
Instruction Fuzzy Hash: 6F017172B0068182FB62AB76B4053DD5250AB9D7E0F485311FBAD476F6DF3CC181C610

Function 00000001400A9BE8 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400A9C18

Part of subcall function 00000001400AAB1C: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400AAB25

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400A9C1E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 6ffe177f5157f79d277372c6ea1b39799971d2e5a1b5546f7eb344a9914ef09c
Instruction ID: 04523a235a29f71bc6c7b1a626fb6df20e7af0258fe547a34f32961bfb1e0df3
Opcode Fuzzy Hash: 6ffe177f5157f79d277372c6ea1b39799971d2e5a1b5546f7eb344a9914ef09c
Instruction Fuzzy Hash: 14E0177072150945FE2B22F318163E400801F6D3F0E2C1B207B750B2F3BE3488D58A20

Function 0000000140098C40 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 0000000140098C56
GetLastError.KERNEL32 ref: 0000000140098C60

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1eb1d4d919d340514f52b5ee7c14653ab2b68de4ee8aa6cf9f2209b3c6d7e0a2
Instruction ID: b52fa26c04212aab859c5ae896bd543063644a9c8dd7e940ebd072c94055b3ed
Opcode Fuzzy Hash: 1eb1d4d919d340514f52b5ee7c14653ab2b68de4ee8aa6cf9f2209b3c6d7e0a2
Instruction Fuzzy Hash: D8E02BB4B0220142FF1B63F3A8983FD12815F9C7C0F040420BF0983372EE3888814714

Function 000000014008AF60 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014008B1B0

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 87a6127ac30b23622a38d36947904b79f4457d1bf17aa16409fec1a630396561
Instruction ID: da5433d3288cf5a0a526c1d61247c75615e0e3a88a26d8c87c4e36aa5818ab75
Opcode Fuzzy Hash: 87a6127ac30b23622a38d36947904b79f4457d1bf17aa16409fec1a630396561
Instruction Fuzzy Hash: 23619A73301A9084EA269F1BD1583AE27A1F749FD8F548611EF6D0B7E5DE39CA86D300

Function 000000014002DEB0 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 000000014002DFE3

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 10bc6e45562824c9429aa28f6b79c5e810a7c3ec3dde2378f92710a177f4f17f
Instruction ID: 51c17bda5550c200c6a7833989ba10c1f01f7f1d71f016f092b22249ce240b3a
Opcode Fuzzy Hash: 10bc6e45562824c9429aa28f6b79c5e810a7c3ec3dde2378f92710a177f4f17f
Instruction Fuzzy Hash: 0A618072B50B8085EB12DBAAD4903DD23A1E74D7E8F40462AFF1957AE9DA74C9928340

Function 00000001400457E0 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140045975

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 816848171f501418f89c1fc00c7346ea8877edef7841e76b7dc2ad7f2b5f6794
Instruction ID: 88a164151cc8353faf59e75a2abb20e029c8a58e390f0121c60b982c8f58206e
Opcode Fuzzy Hash: 816848171f501418f89c1fc00c7346ea8877edef7841e76b7dc2ad7f2b5f6794
Instruction Fuzzy Hash: 5041BE72315B8481EA12AF53A5443DD6366F70DBE5F580626EFAD0B7A6DF38C8518304

Function 000000014007DE00 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 000000014007DE90

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 77f326bdaa11ce90973b30f54824d582fe677ebfc98509bce289812a65ce22c5
Instruction ID: 8539878be2e9e902c4f952c8f8a1d6be5ec9f83221bb27399ebc538b0e08667e
Opcode Fuzzy Hash: 77f326bdaa11ce90973b30f54824d582fe677ebfc98509bce289812a65ce22c5
Instruction Fuzzy Hash: FE519C32A14B808AE712CF69E8403DD73B0F799798F504216EB8C57AA9DF78C685CB40

Function 000000014009913C Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140099164

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ce2a7ca0ea6091a407cf5a5e2992a57a6957e6733fb416fb02be9d1375c25114
Instruction ID: e8858ff0fec7026d46d52c93e3e982fb4afd14998ecd62c25ef9218b9df49fb2
Opcode Fuzzy Hash: ce2a7ca0ea6091a407cf5a5e2992a57a6957e6733fb416fb02be9d1375c25114
Instruction Fuzzy Hash: 5141B83220060497EA769F6FE5803EA77A0E79ABD0F140205FB9A877F1CB38D442C750

Function 0000000140044FE9 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cf54d8b55000f68581a76b622efabc5ffabb5784a99202e54d6246ecb7575a
Instruction ID: b9f7c3d18e9fc718e9f68750a2dc55bbda92819f1f2dc940bfb1a0fb0abbe0fe
Opcode Fuzzy Hash: 90cf54d8b55000f68581a76b622efabc5ffabb5784a99202e54d6246ecb7575a
Instruction Fuzzy Hash: CF31BE72315B4095EE26AB53E5003EDA362E74CBD1F594632FB5D0BBE6EA38C091C348

Function 000000014003FCD0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014003FDD8

Part of subcall function 000000014002B510: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B558

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy
String ID:
API String ID: 317858897-0
Opcode ID: d94b9a2a69c268f486b851b87e23473635957be695ff32d0151c61d1f870f8fb
Instruction ID: 97e6037b4797a068ef0178edcbe608246ecf14e62a64900bd4ebe1e7e1eb7f9f
Opcode Fuzzy Hash: d94b9a2a69c268f486b851b87e23473635957be695ff32d0151c61d1f870f8fb
Instruction Fuzzy Hash: 2321D232711B4441EE1BAB56A5043FA2391EB58BE4F244721EB7C07BE2EB78C9D29300

Function 0000000140045C20 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140045CD2

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 883f8dee6345f69cb4eab342b59d200f8ef62e680ec799e50a26f5bae46e1fb2
Instruction ID: f990d13ba9b1995e0da5ed5b952a9ab2d7d17d4032307640e9227b63b4a75bcd
Opcode Fuzzy Hash: 883f8dee6345f69cb4eab342b59d200f8ef62e680ec799e50a26f5bae46e1fb2
Instruction Fuzzy Hash: BA31B132304A8485EA26AB63D8403ED6360E74CFE8F194631FF6D077E6DA78C4908348

Function 000000014004150A Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041601

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: fc2b4e946975b34f834657763f6c9dc4389becda8e7e609fdc2d25f4694a940e
Instruction ID: 9f065de02e8699617f9461a8276c790da32c661bada7c21a81a4ca73b2b8ce05
Opcode Fuzzy Hash: fc2b4e946975b34f834657763f6c9dc4389becda8e7e609fdc2d25f4694a940e
Instruction Fuzzy Hash: 1321E072311E6484FE16EB56D1543ED2281A788FD4F850621BB1E0BBE6EE38C4918348

Function 000000014009ABD4 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009ACCB

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c89b410e1389cb82359957a1d11d0eb726d726846ac3ab4cc0b188c027a385d4
Instruction ID: 8c05ef98f207ced81cdebc3070fd8dbcc834d1fcd774f14c22416a124c273843
Opcode Fuzzy Hash: c89b410e1389cb82359957a1d11d0eb726d726846ac3ab4cc0b188c027a385d4
Instruction Fuzzy Hash: E3318DB221060086E753AF57C8413ED7A61A79DFE5F924209FB290B3F2DB78C485C765

Function 00000001400B9758 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400B96B5

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f7592383a6c98d4fba61f7e3dde42e88bd2e4ab2cac1154d67cb9460cc1e3cec
Instruction ID: fc355d5895d30ffd1540380ba59b71e238b03132919f1238a9496d9e0c5d9a9e
Opcode Fuzzy Hash: f7592383a6c98d4fba61f7e3dde42e88bd2e4ab2cac1154d67cb9460cc1e3cec
Instruction Fuzzy Hash: B1118132214A4081EA62AF9394113EEA3B1BB9DBC0F544021FF8897BA7EB7DC5414B44

Function 00000001400BBABC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBADF

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0aa9ebfc6785f24b4eccfcde9967f66bba0269257cf9e3546546d224156ecbb2
Instruction ID: 13e69ae66ec78af3e9e7ce95c97f7042131b8b179f5c5ad25fbf63c8b5fe202d
Opcode Fuzzy Hash: 0aa9ebfc6785f24b4eccfcde9967f66bba0269257cf9e3546546d224156ecbb2
Instruction Fuzzy Hash: 1E219332614A4087DB629F5AE4807A977B0F788BD4F644324FB5A876F9DB79C940CB00

Function 00000001400789B0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00000001400789F8

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 6b025b54e0dcc84b3c2947f32e0b7f6b98a3280ab38bb9e29cf354069e188991
Instruction ID: 72c448f64851b44ef0d47f291fbcb967c8de0864198b92fcea4cfbeab45c03dd
Opcode Fuzzy Hash: 6b025b54e0dcc84b3c2947f32e0b7f6b98a3280ab38bb9e29cf354069e188991
Instruction Fuzzy Hash: 97016D32715A8481EB618F1BB94075AA7A0F78CFD4F585135EF9D43B58EA38C8518740

Function 0000000140035813 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140035856

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 19dd94a82b446fece43c3ec0608a8bfd2a43b21f44985dc4239452c70dc369fc
Instruction ID: 46c86765a48e0a4325b0ce012d2570db63820add8cc189426e9b10953f9b7d6b
Opcode Fuzzy Hash: 19dd94a82b446fece43c3ec0608a8bfd2a43b21f44985dc4239452c70dc369fc
Instruction Fuzzy Hash: DB01FF36208A8085EA72DB56F85439B7364F78CBD5F904122DF8D53B69DE39C886CB00

Function 000000014008C804 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014008C823

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 986c70b0d44c87641fd7a2bafc8596790e971a1da67f8b9ca5557413f7120d21
Instruction ID: 850c00b336af4423b93af6fe604bf7543ad1d172a4ae1adb93c9bb4fdbaa00ec
Opcode Fuzzy Hash: 986c70b0d44c87641fd7a2bafc8596790e971a1da67f8b9ca5557413f7120d21
Instruction Fuzzy Hash: D2E0D83262564585EF266B7AE1817ED7260BB4C7F0F148322B734036E6DF3485644611

Function 00000001400B6700 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400B6704

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: d1b5a534f5617b5a49bb6d6dbcc2222ff873ccf4461679138d58d7c7394b5d66
Instruction ID: e5404252072970a5b390b8aee8604883d80fba1bc8fa2517f273712a18d22060
Opcode Fuzzy Hash: d1b5a534f5617b5a49bb6d6dbcc2222ff873ccf4461679138d58d7c7394b5d66
Instruction Fuzzy Hash: 9EC09B39F55902C1F65B1B736C4238F11E07B5D780F804021D30883170DD3C81D74721

Function 00000001400B82F4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400B82FD

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ebdd672c62679ada28959d0ce90671b441c0e42cbdf7fd0cd8041d2b6a409d03
Instruction ID: c1f8abdfa3c11aa9de56e1ee108be8b74f057e80f86e55c58f9080c7b4b0d2de
Opcode Fuzzy Hash: ebdd672c62679ada28959d0ce90671b441c0e42cbdf7fd0cd8041d2b6a409d03
Instruction Fuzzy Hash: 4EB09276A148C0C3C652EB08F84274A7331FB98B08FD00014E38D43624CE2DCA2A8E10

Function 00000001400992A8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00000001400992FD

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5961d92c925a179c987542017da37781590624abdb876bc94f4a0419ded4e0ce
Instruction ID: 37cde42a088fce9459df54da6579d377b91e6ac98e04b7dd035e57d67dfb2eda
Opcode Fuzzy Hash: 5961d92c925a179c987542017da37781590624abdb876bc94f4a0419ded4e0ce
Instruction Fuzzy Hash: 42F05E7831220491FF575BABA8653E922856F9DBC0F4C8534BF0A877F1EE3CC9858224

Function 000000014009B5E0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009B61E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2a123d78f4d769f4acf099b182ff40896aa8a4043ec30c81b9c6a49c6a9f5ef5
Instruction ID: d17b2792fcd96ab1b0cd15c98c0f9a64d373f884e408e1771f1ce4653c2ec12c
Opcode Fuzzy Hash: 2a123d78f4d769f4acf099b182ff40896aa8a4043ec30c81b9c6a49c6a9f5ef5
Instruction Fuzzy Hash: 9AF01C3470160045FE5766B36A917F921809BDCBF1F494724BF3A872E1DA3CD4828610

Non-executed Functions

Function 00007FF7B8803C70 Relevance: 38.9, APIs: 12, Strings: 10, Instructions: 376libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B8803C83

Part of subcall function 00007FF7B8803060: GetCurrentProcess.KERNEL32 ref: 00007FF7B8803071
Part of subcall function 00007FF7B8803060: GetTempPathA.KERNEL32 ref: 00007FF7B88030C8
Part of subcall function 00007FF7B8803060: strlen.MSVCRT ref: 00007FF7B88031E7

GetTempPathW.KERNEL32 ref: 00007FF7B8803CEA
wcslen.MSVCRT ref: 00007FF7B8803D0B
wcslen.MSVCRT ref: 00007FF7B8803D29

Part of subcall function 00007FF7B88F5AE0: memcpy.MSVCRT ref: 00007FF7B88F5B18

strlen.MSVCRT ref: 00007FF7B8803E21
LoadLibraryA.KERNEL32 ref: 00007FF7B8803ED1
GetProcAddress.KERNEL32 ref: 00007FF7B8803EEB
GetProcAddress.KERNEL32 ref: 00007FF7B8803F44
GetProcAddress.KERNEL32 ref: 00007FF7B8803F94
wcslen.MSVCRT ref: 00007FF7B8803FE3
GetProcAddress.KERNEL32 ref: 00007FF7B88040C3
VirtualProtect.KERNEL32 ref: 00007FF7B88040E0

Strings

4.&.Z{,-, xrefs: 00007FF7B880406F
&*, xrefs: 00007FF7B8803ED7
a.dll, xrefs: 00007FF7B8803D1F
:a.dll, xrefs: 00007FF7B8803FD9
Z{,-, xrefs: 00007FF7B8803FF5
B, xrefs: 00007FF7B8803F6D
zSJlTWS\Execute, xrefs: 00007FF7B8803F4C
basic_string::append, xrefs: 00007FF7B88042F3, 00007FF7B8804320
LdrLoadDll, xrefs: 00007FF7B8803EE1
basic_string: construction from null is not valid, xrefs: 00007FF7B8804314

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: AddressProc$wcslen$CurrentPathProcessTempstrlen$LibraryLoadProtectVirtualmemcpy
String ID: &*$4.&.Z{,-$:a.dll$B$LdrLoadDll$Z{,-$a.dll$basic_string: construction from null is not valid$basic_string::append$zSJlTWS\Execute
API String ID: 61348399-2817582949
Opcode ID: 1f8476c20039152cfcb428ce8fdaaa8aabe79512acdc6fe7479142b629008e3b
Instruction ID: 4918ad2fc6817e1bd663775ab98959120967658cd985375c3d3901559d9192f4
Opcode Fuzzy Hash: 1f8476c20039152cfcb428ce8fdaaa8aabe79512acdc6fe7479142b629008e3b
Instruction Fuzzy Hash: A8F1C422619B8682DB24EB19E4403AAF7A1FB96B84FC04131DB9E47B9CDF3CD516C714

Function 000000014006CE40 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 329memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000000014006CEF3
CoInitializeSecurity.OLE32 ref: 000000014006CFA8
CoCreateInstance.OLE32 ref: 000000014006D056
CoSetProxyBlanket.OLE32 ref: 000000014006D0A4
SysAllocStringByteLen.OLEAUT32 ref: 000000014006D0D1
SysFreeString.OLEAUT32 ref: 000000014006D0E1
SysAllocStringByteLen.OLEAUT32 ref: 000000014006D101
SysFreeString.OLEAUT32 ref: 000000014006D112
SysStringByteLen.OLEAUT32 ref: 000000014006D171
SysFreeString.OLEAUT32 ref: 000000014006D1F0
SysFreeString.OLEAUT32 ref: 000000014006D1FA

Strings

@, xrefs: 000000014006D078

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: String$Free$Byte$AllocInitialize$BlanketCreateInstanceProxySecurity
String ID: @
API String ID: 2330523681-2766056989
Opcode ID: 7808df39fc3d1c8c3175c2955d2fb316d1299e2b7191dba5c9e33a0725925d41
Instruction ID: 13c4367a43189977c099a5a69ece56d153c1723905f586f1ec0b8e4762b49491
Opcode Fuzzy Hash: 7808df39fc3d1c8c3175c2955d2fb316d1299e2b7191dba5c9e33a0725925d41
Instruction Fuzzy Hash: 5CE19C32B14B808AF7128B7AE8143ED7362F78DBD8F105616EF5D57AA9DB38C1858344

Function 00000001400818F0 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 361nativelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

GetModuleHandleA.KERNEL32 ref: 000000014008196A
GetProcAddress.KERNEL32 ref: 000000014008197A
OpenProcess.KERNEL32 ref: 00000001400819BF
NtQuerySystemInformation.NTDLL ref: 00000001400819E7
NtQuerySystemInformation.NTDLL ref: 0000000140081A12
GetCurrentProcess.KERNEL32 ref: 0000000140081ADB
NtDuplicateObject.NTDLL ref: 0000000140081B06
NtQueryObject.NTDLL ref: 0000000140081B28
GetFinalPathNameByHandleA.KERNEL32 ref: 0000000140081C22
CloseHandle.KERNEL32 ref: 0000000140081D36
CloseHandle.KERNEL32 ref: 0000000140081DBE

Strings

NtDuplicateObject, xrefs: 0000000140081973
File, xrefs: 0000000140081B5C
ntdll.dll, xrefs: 0000000140081963

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Handle$Query$CloseInformationObjectProcessSystem$AcquireAddressCurrentDuplicateExclusiveFinalLockModuleNameOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2703470732-3955674919
Opcode ID: c487b364e592e22f7ba79ca0058f4a32d8116046041e81eae2fb9bfd7e46abbb
Instruction ID: 43999390ae97c19b914307d4292018259307d826750de190b016f2481e9a1557
Opcode Fuzzy Hash: c487b364e592e22f7ba79ca0058f4a32d8116046041e81eae2fb9bfd7e46abbb
Instruction Fuzzy Hash: 5CE17F72710A809AFB11DBA6D4543ED23A1FB89BD8F408625EF5D27BA9DB38C645C340

Function 0000000140072EC0 Relevance: 16.2, APIs: 1, Strings: 8, Instructions: 434COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400A9B70: AcquireSRWLockExclusive.KERNEL32 ref: 00000001400A9B80

ShellExecuteW.SHELL32 ref: 00000001400733C7

Strings

ios_base::eofbit set, xrefs: 00000001400735CE
ios_base::failbit set, xrefs: 00000001400735C7
ios_base::badbit set, xrefs: 00000001400735BC
.exe, xrefs: 0000000140072F6C
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000000140072FDC
.exe, xrefs: 0000000140072F95
runas, xrefs: 0000000140073349
open, xrefs: 0000000140073340

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AcquireExclusiveExecuteLockShell
String ID: .exe$.exe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 1402300192-2441601502
Opcode ID: f0a6509ef0d1282a0180f37e88137c2549b25b58900e8fab1cdb085e038de08d
Instruction ID: 642fec826a1e3fd6779540e5d4449cad4a9ba132e9692004461db3030459b409
Opcode Fuzzy Hash: f0a6509ef0d1282a0180f37e88137c2549b25b58900e8fab1cdb085e038de08d
Instruction Fuzzy Hash: 7B229C72610B8089EB01DF6AE8843DD77A1F7887A8F505226FB9D07AB9DF78C585C740

Function 00007FF7B881D367 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 431COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7B881E0B6

Strings

P, xrefs: 00007FF7B881E9B3
, xrefs: 00007FF7B881DEC0
P, xrefs: 00007FF7B881E454

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memset
String ID: $P$P
API String ID: 2221118986-3733749394
Opcode ID: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction ID: 3bd357a90efdfc30838ec67fa8bb92fd3805cbe79c008201424f2698b6ed4190
Opcode Fuzzy Hash: 6c4975efa101d25bce8fb2713dfa8b24bac3f22bc36ad2dce6f035114948cbbe
Instruction Fuzzy Hash: E612823292C28287E760BF29D0407BEF791FBAA744F804135DB4947689DF7CE4568B64

Function 00007FF7B88034D0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 406fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7B890AB80: malloc.MSVCRT ref: 00007FF7B890AB97

memcpy.MSVCRT ref: 00007FF7B8803516
CreateFileW.KERNEL32 ref: 00007FF7B880356D
WriteFile.KERNEL32 ref: 00007FF7B880359D
CloseHandle.KERNEL32 ref: 00007FF7B88035AE
wcslen.MSVCRT ref: 00007FF7B8803686
CloseHandle.KERNEL32 ref: 00007FF7B88038C0

Strings

basic_string::append, xrefs: 00007FF7B8803C06, 00007FF7B8803C44, 00007FF7B8803C55

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CloseFileHandle$CreateWritemallocmemcpywcslen
String ID: basic_string::append
API String ID: 3391094610-3811946249
Opcode ID: 3bb7ded17062e4b397386a719e14fc132e9bd4a9d4ca7b8669ef49969fe5b065
Instruction ID: ed15dc85ef61005fa8c36509a08e99bc5039d94839edadc931c99375928ea12b
Opcode Fuzzy Hash: 3bb7ded17062e4b397386a719e14fc132e9bd4a9d4ca7b8669ef49969fe5b065
Instruction Fuzzy Hash: 9F02967261DB8582EA24EB19E40076EE3A1FB96B90F808231DBAD4779CDF3CD455C718

Function 00000001400A3D50 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

TranslateName.LIBCMT ref: 00000001400A3DBD
TranslateName.LIBCMT ref: 00000001400A3DF8
GetACP.KERNEL32 ref: 00000001400A3E3D
IsValidCodePage.KERNEL32 ref: 00000001400A3E65

Strings

utf8, xrefs: 00000001400A3F49

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 5d2d2426c5a5194a24175210fd8136765016d2f1f96d66db4b316bbcbea0d38c
Instruction ID: 5cfce204ad3e52d521be1c37c867fcafba9ba4ef485f8ee24296846217238e8d
Opcode Fuzzy Hash: 5d2d2426c5a5194a24175210fd8136765016d2f1f96d66db4b316bbcbea0d38c
Instruction Fuzzy Hash: 01918C3260078087EB669F23E4417ED63A5E7ACBC0F448221FB59477E6DB39C992CB01

Function 00000001400A4784 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009590D
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400959AD

GetUserDefaultLCID.KERNEL32 ref: 00000001400A48F4

Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009593A
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009594B
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 000000014009595C
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 00000001400959CC
Part of subcall function 00000001400958C8: FlsSetValue.KERNEL32 ref: 00000001400959F4

EnumSystemLocalesW.KERNEL32 ref: 00000001400A48DB
ProcessCodePage.LIBCMT ref: 00000001400A491E
IsValidCodePage.KERNEL32 ref: 00000001400A4930
IsValidLocale.KERNEL32 ref: 00000001400A4946
GetLocaleInfoW.KERNEL32 ref: 00000001400A49A2
GetLocaleInfoW.KERNEL32 ref: 00000001400A49BE

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: dc923a5d096c57da2041771729e7932b82461942625d63c848e344da9d183a2f
Instruction ID: 16d93509c95003d09cb5a81faf5c145d79ac997122476c855c64cffa21997edd
Opcode Fuzzy Hash: dc923a5d096c57da2041771729e7932b82461942625d63c848e344da9d183a2f
Instruction Fuzzy Hash: 1B719D3A7007408AFB129F62E4517EE33A4BB9CBC4F444225EF5953AA5EB38C495CB50

Function 0000000140062510 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000001400626C4
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400626D2
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140062955
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140062963

Strings

value, xrefs: 00000001400625EA, 0000000140062883

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: dd493a39fd7b242ac56ddcbf670e614fae96cd8153661b5f92dd6fe83371a34b
Instruction ID: a0ee57199ec3ce90a2ea8f43caeda29c8c906ea7494d2c7ab5bc718b9e9dd556
Opcode Fuzzy Hash: dd493a39fd7b242ac56ddcbf670e614fae96cd8153661b5f92dd6fe83371a34b
Instruction Fuzzy Hash: DF028D32624BC085EB12CB76D8403ED6761E7997E4F605712FB9E17AEADB78C185C700

Function 00007FF7B88011D9 Relevance: 9.1, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B880124B
malloc.MSVCRT ref: 00007FF7B8801312
strlen.MSVCRT ref: 00007FF7B8801334
malloc.MSVCRT ref: 00007FF7B8801340
memcpy.MSVCRT ref: 00007FF7B8801358
_initterm.MSVCRT ref: 00007FF7B880141A

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_inittermmemcpystrlen
String ID:
API String ID: 1260285541-0
Opcode ID: 4903dc9185d39246619b425608e0136eb5eeb636e7dc1dfbaabc0c8552b91fbc
Instruction ID: e846075dad57280cc034e7ed8b49260059151323c7c9adb4665fc3c62d1620d7
Opcode Fuzzy Hash: 4903dc9185d39246619b425608e0136eb5eeb636e7dc1dfbaabc0c8552b91fbc
Instruction Fuzzy Hash: 92517D39A2E64686FA11BF5DE841779E3D1AF22790FC44034DB1C4739DEE6CE4228728

Function 000000014008D3D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000014008D451
RtlLookupFunctionEntry.KERNEL32 ref: 000000014008D469
RtlVirtualUnwind.KERNEL32 ref: 000000014008D4A4
IsDebuggerPresent.KERNEL32 ref: 000000014008D4DD
SetUnhandledExceptionFilter.KERNEL32 ref: 000000014008D4E7
UnhandledExceptionFilter.KERNEL32 ref: 000000014008D4F2

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 62484be6782a1868f2aab5373510e50ea99112a482b5237f41028b796158fad6
Instruction ID: ec7dd7c93c2cafcbf5452b660a6186fd6c71989d302a7769adecfa476ec907f4
Opcode Fuzzy Hash: 62484be6782a1868f2aab5373510e50ea99112a482b5237f41028b796158fad6
Instruction Fuzzy Hash: 73313F36214F8086EB61DF66E8443EE73A4F789794F540226EB9D43BA9DF38C555CB00

Function 00007FF7B881DA84 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 359COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF7B881E9B3
, xrefs: 00007FF7B881E59E
!, xrefs: 00007FF7B881EC5B

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: $!$P
API String ID: 0-2344582389
Opcode ID: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction ID: 9ef4b1e6db54fe38d39d0e339fc83112036844567e9c950130fed250da0eafef
Opcode Fuzzy Hash: e65736c1dc54ff8f8e83bf8e017ecec5d9c8dafb1b82336238fa23b941b4cde6
Instruction Fuzzy Hash: 09F1E33292C68587E770BF18D0443BAF7A2EBAA340F808135DB4953789DF7CE4568B24

Function 00000001400907A0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000014009080A
memcpy_s.LIBCPMT ref: 0000000140090835

Strings

, xrefs: 0000000140090968

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: 0c772acccd2561090ae59935be1b1d13ce4e89495d086943b039690d891e3a67
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 84C11B727156C58BEB61CF1AE148B9EB7A1F7887C8F048225EB4A43B94DB3CD845CB40

Function 00000001400B8A44 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400B8AA5
IsDebuggerPresent.KERNEL32 ref: 00000001400B8ABD
OutputDebugStringW.KERNEL32 ref: 00000001400B8ACE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400B8AC7

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: add000f596c63ba9086890ad2e143c759155224b8522789efc4995f79ab0692a
Instruction ID: b3baff55db2af0ef0d3f7f0b280b4444a411bf90a176b58064316404aa57ab54
Opcode Fuzzy Hash: add000f596c63ba9086890ad2e143c759155224b8522789efc4995f79ab0692a
Instruction Fuzzy Hash: 98115A32210B4097F7569B27EA453EE33A4FB48784F44812ADB4983AB0EF78D0B4C750

Function 0000000140094A30 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0000000140094A80
GetSystemInfo.KERNEL32 ref: 0000000140094A97
VirtualAlloc.KERNEL32 ref: 0000000140094B04
VirtualProtect.KERNEL32 ref: 0000000140094B1E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 321b67bc3dce9091cca3af2a8210c2363b0b24afac24e17171b156b639bc856e
Instruction ID: 4258e1afaa6455873025acfe4853d78e6786f50bee1bce51619682f1dd863745
Opcode Fuzzy Hash: 321b67bc3dce9091cca3af2a8210c2363b0b24afac24e17171b156b639bc856e
Instruction Fuzzy Hash: 81312A32310A809EEB21DF36D8517D933A5FB4CB88F444126AB1E8BB68DF78D645C740

Function 0000000140066750 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000001400669AE

Strings

parse_error, xrefs: 00000001400667DE
value, xrefs: 00000001400676D3

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 4326292a9e1bd08197330c810dc3064f2862c2b5b1b4a4d0327c770f3fb61afc
Instruction ID: 421e330f328ad8b9b4ed95ecda8ee77e216b13cc7eff753dffc2ada38604a70e
Opcode Fuzzy Hash: 4326292a9e1bd08197330c810dc3064f2862c2b5b1b4a4d0327c770f3fb61afc
Instruction Fuzzy Hash: 8CF1AD72B20A8095EB12DB76E8413ED6362F7997D8F505712FB4D57AAAEF74C284C300

Function 00000001400B63B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400B63D6
FormatMessageA.KERNEL32 ref: 00000001400B6409

Strings

!x-sys-default-locale, xrefs: 00000001400B63C9

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 673506cb31d12670dfbde8b650ceb219f5d226973d02233bc6ec21ba9828e093
Instruction ID: 6e8259666aaa04c0050ce825aa23775dbb0e3623261df5dc7e3128c0f8f5c655
Opcode Fuzzy Hash: 673506cb31d12670dfbde8b650ceb219f5d226973d02233bc6ec21ba9828e093
Instruction Fuzzy Hash: 90018072B04B8082E7528F63F8507EEA7A1F7887C4F484025EB4947BA8DB3CC5058B10

Function 0000000140099898 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009990C

Strings

GetLocaleInfoEx, xrefs: 00000001400998B4, 00000001400998C5

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 287f50d5c011b399992cb6bab078c34d72dd0b19453a01a46759c6e23c60aea6
Instruction ID: b8b15d082959550375d872d2b4a574b6c35111f93f95d4160ec2587d11962505
Opcode Fuzzy Hash: 287f50d5c011b399992cb6bab078c34d72dd0b19453a01a46759c6e23c60aea6
Instruction Fuzzy Hash: 33016235704A8086EB459B5BB5447CEA760EB9DBC0F584436BF4917BB6CE38C5428740

Function 0000000140035E00 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140035E8D
LocalFree.KERNEL32 ref: 0000000140035F1F

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: f21e6fa17400773df5219cb6799421ecb3cc2cfc6e973016af35922b380100ae
Instruction ID: f86567b3b1ec8be5b490864e58408f9f676ebc34b96ddf5a885d773d0d40a402
Opcode Fuzzy Hash: f21e6fa17400773df5219cb6799421ecb3cc2cfc6e973016af35922b380100ae
Instruction Fuzzy Hash: 9A615832B14B809EE712DFB5E4403DD77A1E75878CF048225EB8917EAADB78C5A48340

Function 000000014006FEA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 000000014006FEF8
LocalFree.KERNEL32 ref: 000000014006FF8A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 9f4b79a0373a1bb07a1f6d57d23aee76defce310f3f699e5fe1e45333d4ada4c
Instruction ID: 67641ed3af448434e7319fa557c5d406fdc98635340749bb2cffd34bed4cf3a5
Opcode Fuzzy Hash: 9f4b79a0373a1bb07a1f6d57d23aee76defce310f3f699e5fe1e45333d4ada4c
Instruction Fuzzy Hash: 57413232614A80CAE3218F75E8403ED37A5F75978CF444629BB8C07E9ADB79C5A48744

Function 00000001400A409C Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

EnumSystemLocalesW.KERNEL32 ref: 00000001400A413A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: d452b71020bd1f022492bc6807cc192c2c9e031585c9895097b6e7427efa948c
Instruction ID: 7ba68ebfd2e082917346c4e20934efbd0178457faff08846a1fb6ebd3dab0b21
Opcode Fuzzy Hash: d452b71020bd1f022492bc6807cc192c2c9e031585c9895097b6e7427efa948c
Instruction Fuzzy Hash: 8711B17BA046448AEB168F16D4807ED7BA1F7E8FE1F448225E765437E0DA74CAD1CB40

Function 00000001400A416C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400958C8: GetLastError.KERNEL32 ref: 00000001400958D7
Part of subcall function 00000001400958C8: FlsGetValue.KERNEL32 ref: 00000001400958EC
Part of subcall function 00000001400958C8: SetLastError.KERNEL32 ref: 0000000140095977

EnumSystemLocalesW.KERNEL32 ref: 00000001400A41EA

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 8f5d73e62e28e10308f28ad075867fd029a0f79c06fa79334ee1fb58e0dcdad7
Instruction ID: 650d51a00948b0b7b39d5f8c88aa00294e78a8c84a20bb39946b0cffb9075a66
Opcode Fuzzy Hash: 8f5d73e62e28e10308f28ad075867fd029a0f79c06fa79334ee1fb58e0dcdad7
Instruction Fuzzy Hash: 7801F776B0428086EB564F17E840BD976E2E7B8BE4F458322E77447AE4CB7888C5CB00

Function 0000000140099354 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00000001400993A3

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 4f3cbd580663199aaccb01281376539d086b8c9a154dabf837bfd3fdbd7783f2
Instruction ID: 1be20af52885482918bde62337cf613b9eed61835a97c3d623556c94da20431d
Opcode Fuzzy Hash: 4f3cbd580663199aaccb01281376539d086b8c9a154dabf837bfd3fdbd7783f2
Instruction Fuzzy Hash: 72F01472300B4483E606DB2AE8907D933A5FB9DBC0F548026EB4983375CF3CC6618300

Function 00000001400D0008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: eb586cb3a04548c0adbde56a04425d5c24b419a0c3385a8c7a4060bd729989ce
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: A2F03667E1D7D46AF35356251C7E3CC1FA19BEAF62F4D804A9B48835D3D0160C079321

Function 00000001400D0390 Relevance: .0, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c04fcbd4cbc17e70945f2da77b3784ade4ea1f45a3157327aa1bdcfb84fd8a
Instruction ID: ce99406f94a506be7fc14bf9621620acf46de5d19b27089a98d71f3cef453814
Opcode Fuzzy Hash: d9c04fcbd4cbc17e70945f2da77b3784ade4ea1f45a3157327aa1bdcfb84fd8a
Instruction Fuzzy Hash: C5E06DA7B4EBC04EF31742622C3F74C2ED55B7AB15F0C808F9788032E3B4986D018221

Function 00000001400D0730 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4e891a345a80b6ab1b330d4331481cb0b24106e9af9eabeca1d97d8aa99695
Instruction ID: 2a683a8451ecbb56f980f0c9d1cc897f1c514a0917eb697a5ab48e58a866e488
Opcode Fuzzy Hash: fc4e891a345a80b6ab1b330d4331481cb0b24106e9af9eabeca1d97d8aa99695
Instruction Fuzzy Hash: D5E09B4758F3D01FC3538FB408A959C3F31849798839E918BEAD2E7297D44E495EC32A

Function 00000001400D02C8 Relevance: .0, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1b8df624b78c9f13672db90697f33a184046833f8e29593a1d8da03b41296a
Instruction ID: 3e52525d39e57bbbd7167a3d2a5026f39e520ea7036a62e7442895414421d68b
Opcode Fuzzy Hash: bf1b8df624b78c9f13672db90697f33a184046833f8e29593a1d8da03b41296a
Instruction Fuzzy Hash: 7DA002DBE99384ABCB1609700CE14E91F1679B2900395505EE351D33D3BC8D0A0B9522

Function 00000001400D0090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: 72e6b94385144f95b9e78a3faebda30625cad88c0dbef41df5f82239e748c1b0
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 00007FF7B881C1E0 Relevance: 33.1, APIs: 11, Strings: 11, Instructions: 88stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B881C1EF
strcmp.MSVCRT ref: 00007FF7B881C206
strcmp.MSVCRT ref: 00007FF7B881C21D
strcmp.MSVCRT ref: 00007FF7B881C234
strcmp.MSVCRT ref: 00007FF7B881C24B
strcmp.MSVCRT ref: 00007FF7B881C262
strcmp.MSVCRT ref: 00007FF7B881C279
strcmp.MSVCRT ref: 00007FF7B881C290
strcmp.MSVCRT ref: 00007FF7B881C2A7
strcmp.MSVCRT ref: 00007FF7B881C2BA
strcmp.MSVCRT ref: 00007FF7B881C2CD

Strings

alpha, xrefs: 00007FF7B881C1FC
digit, xrefs: 00007FF7B881C22A
alnum, xrefs: 00007FF7B881C1E5
graph, xrefs: 00007FF7B881C241
cntrl, xrefs: 00007FF7B881C213
print, xrefs: 00007FF7B881C26F
upper, xrefs: 00007FF7B881C2B0
space, xrefs: 00007FF7B881C29D
xdigit, xrefs: 00007FF7B881C2C3
punct, xrefs: 00007FF7B881C286
lower, xrefs: 00007FF7B881C258

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: alnum$alpha$cntrl$digit$graph$lower$print$punct$space$upper$xdigit
API String ID: 1004003707-2937198513
Opcode ID: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction ID: 02e630f69285345c8a206e23744784a2df13370dbae9f189872e1d73f7e91f1e
Opcode Fuzzy Hash: e67547db2ed2332a7f19e7dca95a45f00ddd27835b6d9e5c57363dc607d87d2e
Instruction Fuzzy Hash: 0D31EA64A2E20383FA54BF5F9801775D2465F6A380FC46031DB0D866CDEE5CE866E23D

Function 000000014006CB30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014006CB86
Process32FirstW.KERNEL32 ref: 000000014006CBCA
Process32NextW.KERNEL32 ref: 000000014006CBDF
OpenProcess.KERNEL32 ref: 000000014006CC1B
OpenProcessToken.ADVAPI32 ref: 000000014006CC42
GetTokenInformation.ADVAPI32 ref: 000000014006CC6E
GetLastError.KERNEL32 ref: 000000014006CC7C
GetTokenInformation.ADVAPI32 ref: 000000014006CCBC
ConvertSidToStringSidA.ADVAPI32 ref: 000000014006CCD3
CloseHandle.KERNEL32 ref: 000000014006CD46
CloseHandle.KERNEL32 ref: 000000014006CD51
CloseHandle.KERNEL32 ref: 000000014006CDB6
Process32NextW.KERNEL32 ref: 000000014006CDC3
CloseHandle.KERNEL32 ref: 000000014006CDE9
CloseHandle.KERNEL32 ref: 000000014006CDF2
CloseHandle.KERNEL32 ref: 000000014006CE07

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: 28d5614d1b63fd56c69144723d55c5c830bd806274e720f9e0f5563932fef6bd
Instruction ID: 908b3fb2f10a476486f2afa562155bdad7c3f4e7f03717297370fe69586da0b9
Opcode Fuzzy Hash: 28d5614d1b63fd56c69144723d55c5c830bd806274e720f9e0f5563932fef6bd
Instruction Fuzzy Hash: 0D815B36214B8082EB528B67F8407AEA7A5FB8CBD4F504125EF8D57B68DF78C546CB00

Function 00007FF7B881B8D0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF7B881B9A5
abort.MSVCRT ref: 00007FF7B881B9AB
RtlUnwindEx.KERNEL32 ref: 00007FF7B881BAC1

Strings

CCG!, xrefs: 00007FF7B881B998
CCG , xrefs: 00007FF7B881BB26
CCG , xrefs: 00007FF7B881B93E
CCG!, xrefs: 00007FF7B881B8F9
CCG", xrefs: 00007FF7B881B932

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3297834124
Opcode ID: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction ID: 1d53d645c5d6e4cda7000674acce4fcea8d5104b57afb763fc25b23b7e491779
Opcode Fuzzy Hash: e45fc8471f7cc306109c62edf8b254349e2b495fbaec3812b0675ed500c917f7
Instruction Fuzzy Hash: 0D51C632A14B8182E760AB59E4447A9B370F79EB84F505226EF8D13768EF3DD993C704

Function 00000001400958C8 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400958D7
FlsGetValue.KERNEL32 ref: 00000001400958EC
FlsSetValue.KERNEL32 ref: 000000014009590D
FlsSetValue.KERNEL32 ref: 000000014009593A
FlsSetValue.KERNEL32 ref: 000000014009594B
FlsSetValue.KERNEL32 ref: 000000014009595C
SetLastError.KERNEL32 ref: 0000000140095977
FlsGetValue.KERNEL32 ref: 00000001400959AD
FlsSetValue.KERNEL32 ref: 00000001400959CC

Part of subcall function 00000001400992A8: HeapAlloc.KERNEL32 ref: 00000001400992FD

FlsSetValue.KERNEL32 ref: 00000001400959F4

Part of subcall function 0000000140098C40: HeapFree.KERNEL32 ref: 0000000140098C56
Part of subcall function 0000000140098C40: GetLastError.KERNEL32 ref: 0000000140098C60

FlsSetValue.KERNEL32 ref: 0000000140095A05
FlsSetValue.KERNEL32 ref: 0000000140095A16

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 20a63ad23df30dbf7d704f8b82e78d7ac72f052c437d19d22c322cc3c85e3d6b
Instruction ID: 28dcf10232930b1ea106eb9cf858801f198c52737c0ab290223808406cbb09f8
Opcode Fuzzy Hash: 20a63ad23df30dbf7d704f8b82e78d7ac72f052c437d19d22c322cc3c85e3d6b
Instruction Fuzzy Hash: 88416C3031560082FA6BBB7795663E956824F4DBF1F580729BB761B7F2EE38C8418301

Function 00007FF7B881FFD0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 446COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B88202B5

Strings

UUUU, xrefs: 00007FF7B88200FE

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID: UUUU
API String ID: 1992160199-1798160573
Opcode ID: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction ID: 1c6bcf170e97eebd1e41345d29a30d77e0b82f43322699474aeda622261c03f4
Opcode Fuzzy Hash: f77c88ed8e2e0546aa95018f39101ab1acda64fb455bfe48ab528bf610eb644e
Instruction Fuzzy Hash: B5127772D2810287E765AF2DC150739F7E1EB66B58F948235CB0D466CCDA38E852CB68

Function 00007FF7B881ADC0 Relevance: 16.6, APIs: 11, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B881AE21
TlsGetValue.KERNEL32(?,?,?,00007FF7B881A375), ref: 00007FF7B881AE4A
GetLastError.KERNEL32(?,?,?,00007FF7B881A375), ref: 00007FF7B881AE4F
LeaveCriticalSection.KERNEL32 ref: 00007FF7B881AE77
free.MSVCRT ref: 00007FF7B881AEB7
DeleteCriticalSection.KERNEL32 ref: 00007FF7B881AEDD
InitializeCriticalSection.KERNEL32 ref: 00007FF7B881AF77

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorInitializeLastLeaveValuefree
String ID:
API String ID: 100439675-0
Opcode ID: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction ID: 7d992e43b2596a16d3dbbc4e9fc4816c17d4d064b4d823b47f4e26cc2158f521
Opcode Fuzzy Hash: 30aa02ae5bca33457ef710422f6a64a41ac8ead17b866e7ea412da05448c15c7
Instruction Fuzzy Hash: D8412E21A2E50287FA55BB59E840678E250AF7BB91FDC4435CB0D47698EF3CE8538368

Function 0000000140072940 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400729BD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140072A05
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B81
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B94
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072B9A

Strings

bad locale name, xrefs: 0000000140072B87
true, xrefs: 0000000140072ABC
false, xrefs: 0000000140072A8D

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: ae88cd937f36c9743e4cf492e26538404faf03bacae6fdef2e26eed03261b8a2
Instruction ID: e066986b790d9d11d0d243cedda6a3cc5bafb9ebfb83a164bf58ddc58a77a579
Opcode Fuzzy Hash: ae88cd937f36c9743e4cf492e26538404faf03bacae6fdef2e26eed03261b8a2
Instruction Fuzzy Hash: 35711932711B408AFB16DFA2E4503EC33B5EB98788F044529AF4927BAADF38C555D385

Function 0000000140090D64 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090DA8
_invalid_parameter_noinfo.LIBCMT ref: 0000000140091180
_invalid_parameter_noinfo.LIBCMT ref: 000000014009142B

Strings

p, xrefs: 0000000140090ED2
p, xrefs: 0000000140090E5A
0, xrefs: 00000001400911D0
f, xrefs: 0000000140090ECA

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: 424b79af020e58dd710012948c1de64fe2c08c3ce7a620c69024c20bdefc1009
Instruction ID: 7a1535432eec6c5026fa7d0a87deccdfacc68b181622ded096d4695016ab780a
Opcode Fuzzy Hash: 424b79af020e58dd710012948c1de64fe2c08c3ce7a620c69024c20bdefc1009
Instruction Fuzzy Hash: 1212D13270824296FB266B17E0547FEB6A2F3C87D4F988116F79647AE4D738C980CB50

Function 00007FF7B881A530 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7B881A64B

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7B881A6E1
Address %p has no image-section, xrefs: 00007FF7B881A5A2, 00007FF7B881A6F5
VirtualProtect failed with code 0x%x, xrefs: 00007FF7B881A6BE
Mingw-w64 runtime failure:, xrefs: 00007FF7B881A567

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: ba1ad689428b48396fa565d55f37374c51d177facfa230d2a8edbf84c3bf7fa1
Instruction ID: 2bb0a85b859d337fd442fe8a9153b08bc7158dc2d9197c209f03f6e4d5b668cc
Opcode Fuzzy Hash: ba1ad689428b48396fa565d55f37374c51d177facfa230d2a8edbf84c3bf7fa1
Instruction Fuzzy Hash: AB51E872A1964682EA10BB59E800AA9F764FF6AB90FC44131DF4C07398EE3CE457C758

Function 00000001400993D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009954F
GetProcAddress.KERNEL32 ref: 000000014009955B

Strings

api-ms-, xrefs: 0000000140099499
ext-ms-, xrefs: 00000001400994AC

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ae679bdfceee675f1571733c1c63cbbbec3b6b3dc0e35fb4a25fe1e49f4f57a7
Instruction ID: 76867b2f50e267d13f3c23fb1344ffb9304965bf71fdab833d42e5d4e69427de
Opcode Fuzzy Hash: ae679bdfceee675f1571733c1c63cbbbec3b6b3dc0e35fb4a25fe1e49f4f57a7
Instruction Fuzzy Hash: 01418172311A4082FB17DB1BA9147DA6395BB5DBE0F494229BF1D8B7A8EE3CC4468340

Function 00007FF7B8820800 Relevance: 12.4, APIs: 8, Instructions: 355COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B8820AB5

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction ID: 61e25ce6bcb22854549b2a7df8ada9f839f9436a871eaf9d3151e7afb4576115
Opcode Fuzzy Hash: f294bb9004327c1bec0d0349a18b948e00fe3e45a64ad46b07d7e6d5aa7348cc
Instruction Fuzzy Hash: 6DE188B2A241018BE774AF29C150739F7E1EB66B58FA58235CB094778CDA38EC52CF54

Function 0000000140072D70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 0000000140072DDB
InternetOpenUrlA.WININET ref: 0000000140072E10
InternetReadFile.WININET ref: 0000000140072E31
InternetReadFile.WININET ref: 0000000140072E6F
InternetCloseHandle.WININET ref: 0000000140072E7C
InternetCloseHandle.WININET ref: 0000000140072E85

Strings

File Downloader, xrefs: 0000000140072DD4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 210ff5028c4d6a4313cb91af622c9ef4241b8e7ae994910c4c878489564db72a
Instruction ID: 5fa8a96f82adfbe2566a4b915101b8e54a631cf06f5522793a8622ffc361334d
Opcode Fuzzy Hash: 210ff5028c4d6a4313cb91af622c9ef4241b8e7ae994910c4c878489564db72a
Instruction Fuzzy Hash: 64312632214A8086EB228F26F95079EB7A0FB89BC4F545125FF8943B68DF7CC5958B00

Function 00007FF7B8802F30 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7B8802F81
GetProcAddress.KERNEL32 ref: 00007FF7B8802FD0
wcslen.MSVCRT ref: 00007FF7B8803016

Strings

4.&., xrefs: 00007FF7B8802FA8
TEMP, xrefs: 00007FF7B8802FD6
J, xrefs: 00007FF7B8802F8F
basic_string: construction from null is not valid, xrefs: 00007FF7B8803050

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: AddressLibraryLoadProcwcslen
String ID: 4.&.$J$TEMP$basic_string: construction from null is not valid
API String ID: 1064947497-679671853
Opcode ID: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction ID: b8f04a880d77ab0e59db24c152d29ec9f335aa637cdc36f0a1e11ccb38eaad12
Opcode Fuzzy Hash: 2b3813a550977f849a814cab301f845937e69ffc04f6b1439139e8e5e0fef5e4
Instruction Fuzzy Hash: 8831E432619A8693EB12AB18E4006AAF760FB96B84FC04032DB9D17B5CDF3CD517C758

Function 00007FF7B881BBF0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF7B881BC22
RaiseException.KERNEL32 ref: 00007FF7B881BC44
abort.MSVCRT ref: 00007FF7B881BC70
RaiseException.KERNEL32 ref: 00007FF7B881BCB7

Strings

CCG , xrefs: 00007FF7B881BC1D
CCG", xrefs: 00007FF7B881BC3F
CCG", xrefs: 00007FF7B881BCB2

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionRaise$abort
String ID: CCG $CCG"$CCG"
API String ID: 3325032505-1179968548
Opcode ID: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction ID: 0b8a6adebb48c40bd0660d5dc0db1d1ed6ca430e3a10adc7277ace55c66f73e0
Opcode Fuzzy Hash: dc1771becb5f7d7a174ac4ee873c316158b39dbcf1eb3e3089c99a13fe7347f6
Instruction Fuzzy Hash: C7219133A25B8187E340DF58E4403A97760F7D9788F60A22AEA8D57764EF7AC1928700

Function 00007FF7B8825C10 Relevance: 11.5, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00007FF7B8825C87
LeaveCriticalSection.KERNEL32 ref: 00007FF7B8825CBD

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalLeaveSectionfree
String ID:
API String ID: 1679108487-0
Opcode ID: 95fe868276fcc675441e8b6bcbd2e592402446384d147c482bf95a0a74b21bb4
Instruction ID: 1412ca6f12abc74460b03ead7f8725540503f0a1e29805ebfece82d622953c04
Opcode Fuzzy Hash: 95fe868276fcc675441e8b6bcbd2e592402446384d147c482bf95a0a74b21bb4
Instruction Fuzzy Hash: D0917331A5A64286EB94AF1DD945378E2A1BF26780FC44532CB0D0779CEF3CE4638368

Function 00007FF7B8802600 Relevance: 10.6, APIs: 7, Instructions: 105stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7B88026EA
strcpy_s.MSVCRT ref: 00007FF7B880272E
strcpy_s.MSVCRT ref: 00007FF7B8802741
strcpy_s.MSVCRT ref: 00007FF7B880274F
_strlwr.MSVCRT ref: 00007FF7B8802755
_strlwr.MSVCRT ref: 00007FF7B880275E
strstr.MSVCRT ref: 00007FF7B880276A

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcpy_s$_strlwr$ByteCharMultiWidestrstr
String ID:
API String ID: 606828236-0
Opcode ID: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction ID: ed20c43e651065d40d348aacd5dd802e9c45fe48de6fde3cc156a905358ad263
Opcode Fuzzy Hash: c9a725f9162f59c41cee2fa39016cf96b5296817a48e5951eed084d6514580bc
Instruction Fuzzy Hash: 6F419362208BC1D6DB219F19E8407AAE7A5F79ABD4F804121EF4D17B98CF7CD142C704

Function 00007FF7B8804350 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880440C
strcmp.MSVCRT ref: 00007FF7B880445C

Strings

h}/9, xrefs: 00007FF7B880442B
B, xrefs: 00007FF7B8804415
I^2$, xrefs: 00007FF7B880437A
B, xrefs: 00007FF7B8804382
B, xrefs: 00007FF7B88043C6

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: B$B$B$I^2$$h}/9
API String ID: 1004003707-632112022
Opcode ID: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction ID: 76c101f178a4d2c4408261cccc7fcf3712666e2a7c6c2ebe59865dcfdf5d0fef
Opcode Fuzzy Hash: e456b41c8218c5c2878edad117f7d1c39dace70967b1e9da172d671df5be1f19
Instruction Fuzzy Hash: 61312772A0D78587DB219F29E0402AAFBA0E7A6788FC44135EB8D07B48DB7CC512CF54

Function 00000001400A77C8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400A77F9
GetLastError.KERNEL32 ref: 00000001400A7805
CloseHandle.KERNEL32 ref: 00000001400A781D
CreateFileW.KERNEL32 ref: 00000001400A7848
WriteConsoleW.KERNEL32 ref: 00000001400A7867

Strings

CONOUT$, xrefs: 00000001400A7829

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 6204a89cdd06f09cfc3486d0d96b2f463e47156f2c9ace21a11958914875a066
Instruction ID: b2c7ae89afa13f93ab2f89b082ff298c5d837d5d0260bd35e7c271c2b071468c
Opcode Fuzzy Hash: 6204a89cdd06f09cfc3486d0d96b2f463e47156f2c9ace21a11958914875a066
Instruction Fuzzy Hash: E6116A32710A4086E7528B57F854B9DA2A1FB9CFE4F444224EB6D877A4DF3CC845CB50

Function 00007FF7B881F340 Relevance: 9.4, APIs: 6, Instructions: 414COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00007FF7B881F4C2
fputc.MSVCRT ref: 00007FF7B881F53A
fputc.MSVCRT ref: 00007FF7B881F592

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction ID: 5236659b8bfcb8fb7feaf862593e814572aa2b847969d7f5805c4e7ff6bfd7ef
Opcode Fuzzy Hash: 3c91229a8620996d77b275314aee762391fa8306f714f08d228cfd6e98818314
Instruction Fuzzy Hash: 60F1DA62E2858247E761BF2D9004739E691AB2A768F948234CB1D57BC8CE3CFC53C764

Function 00000001400B866C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400B8719
MultiByteToWideChar.KERNEL32 ref: 00000001400B87B5
MultiByteToWideChar.KERNEL32 ref: 00000001400B885E
MultiByteToWideChar.KERNEL32 ref: 00000001400B8888
MultiByteToWideChar.KERNEL32 ref: 00000001400B8930
CompareStringEx.KERNEL32 ref: 00000001400B897D

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 8e7ed421b9ab10fa64d8ac8429b202f25cf3c3f4c1382695c7f8b6ad37d36eca
Instruction ID: 00de4b50e6229e7b19f2ebf843531fdc6470dc3cb5f6c1b8a30933229632cc52
Opcode Fuzzy Hash: 8e7ed421b9ab10fa64d8ac8429b202f25cf3c3f4c1382695c7f8b6ad37d36eca
Instruction Fuzzy Hash: D1A18E72214A808AEF338FA294543ED66A1F748BE8F584622FF59077F5EB38C945C341

Function 000000014006D2C0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 469COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.ADVAPI32 ref: 000000014006D6CB
RevertToSelf.ADVAPI32 ref: 000000014006D6E9

Strings

APPB, xrefs: 000000014006D80A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ImpersonateLoggedRevertSelfUser
String ID: APPB
API String ID: 1724704203-1278849820
Opcode ID: ae51c3e9b5de2dbc967a7b30e9ee5455ece37fadcc315d5563a607e0cb33d80c
Instruction ID: cd5e0d61c4494fc0e7b834e799b1642ebb3b46db86928f36585c127bdd859749
Opcode Fuzzy Hash: ae51c3e9b5de2dbc967a7b30e9ee5455ece37fadcc315d5563a607e0cb33d80c
Instruction Fuzzy Hash: 4612AF72B2069089FB129BAAD8543DD3762E7497E8F605616FB6D17AFADF74C480C300

Function 00000001400B830C Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400B837C
MultiByteToWideChar.KERNEL32 ref: 00000001400B841A
LCMapStringEx.KERNEL32 ref: 00000001400B8483
LCMapStringEx.KERNEL32 ref: 00000001400B84D5
LCMapStringEx.KERNEL32 ref: 00000001400B857A
WideCharToMultiByte.KERNEL32 ref: 00000001400B85D4

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: aff1d1866dc12ffdbaee311dbe293056c30c40e0640524166ebc9974f98794e1
Instruction ID: 8b8c5f4bf6079c73f73cf44f0fe3ced5764d8e641cf6acd2d34b214dda9e4180
Opcode Fuzzy Hash: aff1d1866dc12ffdbaee311dbe293056c30c40e0640524166ebc9974f98794e1
Instruction Fuzzy Hash: 6D817E72200B8086EB368FA6E84079972E5FB98BE8F544625FF5947BF8DB38C545C700

Function 00007FF7B8826EA0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00007FF7B8826ECB
___lc_codepage_func.MSVCRT ref: 00007FF7B8826ED3
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7B8826F23
MultiByteToWideChar.KERNEL32 ref: 00007FF7B8826F55

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID:
API String ID: 2785433807-0
Opcode ID: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction ID: 62a70c5c421fe129b6ff5ccdad0238f9b936d3ebd1856f8d07055812e7f60570
Opcode Fuzzy Hash: b8ade29cbcad1670599392aa2893148449ef957c3984b89b714999f8b731dc73
Instruction Fuzzy Hash: C3314E23B192128BEB52AF19E800779E5506F627B8F844236EF68477C8DE3DD057C714

Function 00007FF7B8801E18 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

rand.MSVCRT ref: 00007FF7B8801E18
rand.MSVCRT ref: 00007FF7B8801E35
rand.MSVCRT ref: 00007FF7B8801E5A

Strings

Performing arithmetic operations on: , xrefs: 00007FF7B8801E73
and , xrefs: 00007FF7B8801E97
+-*/, xrefs: 00007FF7B8801E7C

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: rand
String ID: and $+-*/$Performing arithmetic operations on:
API String ID: 415692148-3864222635
Opcode ID: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction ID: 4111870597fb064845dc8e3534a5d5ef0671d5b364bc2731dbf3a1dd748c6219
Opcode Fuzzy Hash: f0d3409b9f0d6e33847339fe865cbda917983b98c22d437aab5b055a0af117dc
Instruction Fuzzy Hash: C5214902F1A61746EA15BA2E884527DD2926FD3B80FC89031DF1D0B39EDD3CE9028368

Function 0000000140095A40 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140095A4F
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095A85
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AB2
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AC3
FlsSetValue.KERNEL32(?,?,-256325B0FF13704B,0000000140091B75,?,?,?,?,0000000140098C74), ref: 0000000140095AD4
SetLastError.KERNEL32 ref: 0000000140095AEF

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 53182a0231f8343e27079854997c91253693178c60a234920c20c6ea30be93b6
Instruction ID: 4e56595a93ee8ec0115da1d98981107824e97e2991e46ab42691fcb503f31c77
Opcode Fuzzy Hash: 53182a0231f8343e27079854997c91253693178c60a234920c20c6ea30be93b6
Instruction Fuzzy Hash: 4E117F3030524042FA5B677756963ED65525F4C7F0F540729BB3647BF6EE38C4418302

Function 000000014002D8F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002D94F

Part of subcall function 00000001400B64A0: AreFileApisANSI.KERNEL32 ref: 00000001400B64B2

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DBF7
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DCB1

Strings

: ", xrefs: 000000014002DA0A
", ", xrefs: 000000014002DA3D

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 276e0ee92c9baf106450452eb8121fb477a8fed21e0a6bb784b23281ffa35dcc
Instruction ID: 2f9f9c717eaa61eeb0c67eb9e7509bd531f61b69cecee47917d4c8967017d8a8
Opcode Fuzzy Hash: 276e0ee92c9baf106450452eb8121fb477a8fed21e0a6bb784b23281ffa35dcc
Instruction Fuzzy Hash: D6B18A72700A4096EB02DF66E4543EC3361E759BC8F508626EF5D57BAADF38C995C380

Function 00007FF7B8804480 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7B8804605

Strings

>, xrefs: 00007FF7B880451E
@, xrefs: 00007FF7B88044EC
MF3A, xrefs: 00007FF7B880456F
@, xrefs: 00007FF7B880459E

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: HandleModule
String ID: >$@$@$MF3A
API String ID: 4139908857-2332176444
Opcode ID: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction ID: 1c4fc895c93ca8fe385ae989af06836db4e5fc0da9a232b9b4f0a669a90514ef
Opcode Fuzzy Hash: 328f68d8ccde1d471623e3a916f8d5002275435361e7f0ce1315f7b9a25dafef
Instruction Fuzzy Hash: 6B41B132A09BC582DB219B18F0407AAF7A0F79A748FC14526DB8D03B5CEB7DD556CB44

Function 00007FF7B88F0A00 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

basic_string::_M_create, xrefs: 00007FF7B88F0B49, 00007FF7B88F0BE2, 00007FF7B88F0C72, 00007FF7B88F0D02, 00007FF7B88F0D92

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: basic_string::_M_create
API String ID: 0-3122258987
Opcode ID: 44b85481758d657289992c4c4b478202b050daf0a3589029b5cd0d7c519323b4
Instruction ID: 3d8c2585763da543424a8c75d215488018768c3fe1df2abff2dc060a936849f5
Opcode Fuzzy Hash: 44b85481758d657289992c4c4b478202b050daf0a3589029b5cd0d7c519323b4
Instruction Fuzzy Hash: 0EA1FD62B2564689ED24BF19D8400B8E251AF76BE4FD88631DF2D473D5DF2CE4A2C314

Function 00007FF7B881F9C0 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction ID: ea3a16e4bd8444678ebc841e2bf61648690cb61ee83fa8306aa05157ec32abb8
Opcode Fuzzy Hash: 64ea054b2a2157d068e8ab586f5ae1021de10276e6996cd183b54ca99c2502e6
Instruction Fuzzy Hash: 93C16372E2915287E761BE28C014339F7A1EB69B58F998231CB0D57389CE3CEC52C764

Function 00007FF7B8803060 Relevance: 7.7, APIs: 5, Instructions: 231stringCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7B8803071
GetTempPathA.KERNEL32 ref: 00007FF7B88030C8
strlen.MSVCRT ref: 00007FF7B88031E7
strlen.MSVCRT ref: 00007FF7B88032A9
memcpy.MSVCRT ref: 00007FF7B88032EE

Part of subcall function 00007FF7B883EE70: memchr.MSVCRT ref: 00007FF7B883EEB1

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen$CurrentPathProcessTempmemchrmemcpy
String ID:
API String ID: 1237187527-0
Opcode ID: f4e7bedf47afd40fecaf14e77b810dd7dad75451e5cfdd79f2a6c94f68c429c1
Instruction ID: 04ce81bc967ca1c5d2d944a41b424c57d0a0eccb9b6a6248310eabb2d85f633c
Opcode Fuzzy Hash: f4e7bedf47afd40fecaf14e77b810dd7dad75451e5cfdd79f2a6c94f68c429c1
Instruction Fuzzy Hash: C0A19322618B8582EB109B19E44036AE7A1FB96BD0F944235EFAD47BDCDF7CD016CB14

Function 000000014009CBF8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014009CC3B
_set_statfp.LIBCMT ref: 000000014009CC59
_set_statfp.LIBCMT ref: 000000014009CC82
_set_statfp.LIBCMT ref: 000000014009CEBB

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f9d29a29cdd2ffd341ecb2d23d59fd5f68f4680a083a3d8e41450f0123bb1665
Instruction ID: 51537d9657ec2fdfa4f10ec80af9299248d2a692f50d6fc6d23c4d355d044b15
Opcode Fuzzy Hash: f9d29a29cdd2ffd341ecb2d23d59fd5f68f4680a083a3d8e41450f0123bb1665
Instruction Fuzzy Hash: C881F4B2A24A8449F7778F3AA450BEABA60FB5D7D8F044315FB5A275F4DB34C5818A00

Function 00007FF7B88EE690 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7B88EE730
memcpy.MSVCRT ref: 00007FF7B88EE764

Strings

Result of , xrefs: 00007FF7B88EE692
basic_string::_M_create, xrefs: 00007FF7B88EE84A

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy
String ID: Result of $basic_string::_M_create
API String ID: 3510742995-1160149181
Opcode ID: ecf818389d4a64880c138437d3c7078a4c229c0a1f64958101a06294d39f3f93
Instruction ID: 48f197325ab64fe895bd921d12e11bba02ed8e223d36681de3f64f81ccde95b4
Opcode Fuzzy Hash: ecf818389d4a64880c138437d3c7078a4c229c0a1f64958101a06294d39f3f93
Instruction Fuzzy Hash: A8413826B1A69652EB21BA19844027AE351AB22BD9FD44933CF1C07B8CDF2CE413C324

Function 00000001400A8B70 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400A8B98
_set_statfp.LIBCMT ref: 00000001400A8BB3
_set_statfp.LIBCMT ref: 00000001400A8BCF
_set_statfp.LIBCMT ref: 00000001400A8C0B

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: ec8299edcefb6fa201b4cd1aeee9dcae6e47e61ba1c4a4a6e0c30bc807d4dc5c
Instruction ID: 9eabe2c6862708b434ee5f188970f655e061dec2d8f65aedb1ea2276e73e5cc0
Opcode Fuzzy Hash: ec8299edcefb6fa201b4cd1aeee9dcae6e47e61ba1c4a4a6e0c30bc807d4dc5c
Instruction Fuzzy Hash: 6E11E5B2A60E0105F67A112BED463E925406B7C3F8F890725BF67072F68B38CCC18B24

Function 0000000140095B08 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B27
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B46
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B6E
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B7F
FlsSetValue.KERNEL32(?,?,?,000000014008D367,?,?,00000000,000000014008D602,?,?,?,?,-256325B0FF13704B,000000014008D58E), ref: 0000000140095B90

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 592592041d91ff65a3814a993f8ff53005f94ceea8684b4c31b9de786b746a68
Instruction ID: 40ffcb6e7276c6b56e20ef340f0400dac99e19fffa2c2d3576c81a9cdb817faf
Opcode Fuzzy Hash: 592592041d91ff65a3814a993f8ff53005f94ceea8684b4c31b9de786b746a68
Instruction Fuzzy Hash: 5C118F7070924042FA5AAB77A6523E966825F8C7F0F444369BB3957BF6DF7CC4418701

Function 0000000140088BA0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140088D7B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140088F84
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140089100

Strings

3G, xrefs: 0000000140088F90

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 3G
API String ID: 118556049-4175570335
Opcode ID: ea31b47cca7f9941543477e0ef4a89234e63e907905875329dbbaa8dc0ab6de9
Instruction ID: ecd787d7bad4783b418fa305d3fcccd9f8caea627933b618d2d429a6fbf68683
Opcode Fuzzy Hash: ea31b47cca7f9941543477e0ef4a89234e63e907905875329dbbaa8dc0ab6de9
Instruction Fuzzy Hash: B8E1AD73311B8485EA66DB66E4447AA73A4F758BE4F144725AFAD07BE5EF38C290C300

Function 00007FF7B881A710 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 250memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF7B8A9F060,00007FF7B8A9F068,00007FF7B8A9F0B0,?,?,?,?,00000001,00007FF7B8801244), ref: 00007FF7B881A8F3

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7B881AA8A
Unknown pseudo relocation bit size %d., xrefs: 00007FF7B881AA74
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B881AA96

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: e2176e22cacbc1e56bd42fc89a58474ee1bbcd1f4fcc8751c36bb341390877a3
Instruction ID: b22edca21e3cda68762b358c09c0e83156e0363703058f9d460c6a84ee1230ee
Opcode Fuzzy Hash: e2176e22cacbc1e56bd42fc89a58474ee1bbcd1f4fcc8751c36bb341390877a3
Instruction Fuzzy Hash: BB91D726E2950247EA10775CD900679E361AF7A764F948231CB2D07BDCEE3CE8638328

Function 00000001400BAB50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BAE2F

Part of subcall function 00000001400A73AC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A73C9

Strings

UTF-8, xrefs: 00000001400BADAE
UTF-16LEUNICODE, xrefs: 00000001400BADCD
ccs, xrefs: 00000001400BAD6A

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 851a617801b4cfd31061c4c6c380f6ef5142011fd0a99ac6d62129d95d7a0a73
Instruction ID: c25c3288be8e472c6befd42f9ca98e390cbf50fe56392b6ea39b80f7af3d53ba
Opcode Fuzzy Hash: 851a617801b4cfd31061c4c6c380f6ef5142011fd0a99ac6d62129d95d7a0a73
Instruction Fuzzy Hash: F8819DB2600A4086FB778FABC1507F93BB0A31ABC8F658005FB4667AB5D33DC9429711

Function 00000001400461F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140046260
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400462A8
_Getcoll.LIBCPMT ref: 00000001400462DC

Strings

bad locale name, xrefs: 00000001400463E1

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: a74d05edcc680aa49797f08e4eedccf6035f239cca559bda27cab53509a1a993
Instruction ID: 2dd48ec296852500dd2f0364dd46106788e004d0cc0eadaa75e91df770a0f7fb
Opcode Fuzzy Hash: a74d05edcc680aa49797f08e4eedccf6035f239cca559bda27cab53509a1a993
Instruction Fuzzy Hash: 5C714B32702B408AFB16DFB6D4903DC3376AB48B98F044125EF592BBAADE348555D389

Function 0000000140059AB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059C90
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059C9D

Strings

at line , xrefs: 0000000140059B3A
, column , xrefs: 0000000140059B68

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 24fe7f42ac002282dae115578377fdd728047d5eb7b3d8577a3df730c4bd1d07
Instruction ID: f5178fb3b268f0b48bb0946d76aaafe813ca48c51b666f22c5d6955aa079505b
Opcode Fuzzy Hash: 24fe7f42ac002282dae115578377fdd728047d5eb7b3d8577a3df730c4bd1d07
Instruction Fuzzy Hash: E851A072B04B8081EA11DB1AF58039EB761F799BD4F104212FBA907BAADF79C591C740

Function 000000014002C670 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002C6DF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002C727
_Getctype.LIBCPMT ref: 000000014002C765

Strings

bad locale name, xrefs: 000000014002C81E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: b3b85aaa9564d3eb53080caaeaa34e3804193ba04b17ecad880dd215a6707056
Instruction ID: 974744e1641dd82f39cde997d7380458ab7219ed9018711764406166cb430a43
Opcode Fuzzy Hash: b3b85aaa9564d3eb53080caaeaa34e3804193ba04b17ecad880dd215a6707056
Instruction Fuzzy Hash: A2512A36711B408AEB16DFB2E4907ED33B5FB48788F044429EB4A27AA5DF34C915D384

Function 000000014007EAB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014007EB3B

Strings

?, xrefs: 000000014007EAF0

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 9ce2cab3e5638af268662656aab553d784792685103362ac06a3506950342615
Instruction ID: de8b63d0aba4a3d42243ea9766a5ca2326035d68d787c69f021cc9a1ee6e9200
Opcode Fuzzy Hash: 9ce2cab3e5638af268662656aab553d784792685103362ac06a3506950342615
Instruction Fuzzy Hash: 43418E72619B8482EA518B26F4803AEB760F79D7D4F105216FB9A43AA9DF3CC094CB40

Function 00007FF7B881AB00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF7B881AB15

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction ID: ab82929384c68d686b40af2b673ba23911195f0c40cd869c557a2fdf9b1a4957
Opcode Fuzzy Hash: d3dbc5fc667eaa8116ddc9648ae4a223ff8f86823c9b38466b26c19195cb2a75
Instruction Fuzzy Hash: 5D215E60F2918247FA68726DD151338E1829FAF760F984935C71D863DDDD1CA8E3413D

Function 00000001400B6450 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400B6466
GetProcAddress.KERNEL32 ref: 00000001400B6476

Strings

GetTempPath2W, xrefs: 00000001400B646C
kernel32.dll, xrefs: 00000001400B645F

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: feccffff2a60b544ffbbbafe503937a9e42bf7f10482beb47b79b4c0f892a682
Instruction ID: b479fef3ac197ef4dce19ec26a24247ec8550dec43ddafd548e24bb2c55acab6
Opcode Fuzzy Hash: feccffff2a60b544ffbbbafe503937a9e42bf7f10482beb47b79b4c0f892a682
Instruction Fuzzy Hash: 9EE01A75704B0582EE469B12F9987AD2361FF8CBC4F589029EB1E07334DE3CD4869B00

Function 00007FF7B881A070 Relevance: 6.3, APIs: 5, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B881A0F5
memcpy.MSVCRT ref: 00007FF7B881A10E
free.MSVCRT ref: 00007FF7B881A119

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction ID: 9c5d4cdfd26ad83e7099dba629c5e9ec85fa04a65d3d3fea2497901b9ffe0062
Opcode Fuzzy Hash: 616034b4082db6133acc050cdb7f1ef8251caf1ace96c15328d116e499333b8e
Instruction Fuzzy Hash: A331ED61A2964287F9627E19EA00379D2515F66BE0F988230DF5E87BCCDE3CD4534314

Function 0000000140097F54 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000000140097FDB
WriteFile.KERNEL32 ref: 00000001400982A2
WriteFile.KERNEL32 ref: 00000001400982EB
GetLastError.KERNEL32 ref: 00000001400983AC

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 7f3eb5a86098c1c517e33af41decd246e6b98b795eba64b701eaa93da67d498f
Instruction ID: a6b027b0e07357715d3c80cbbe1cd0166f8b724c902756b6abe27a254a4597ff
Opcode Fuzzy Hash: 7f3eb5a86098c1c517e33af41decd246e6b98b795eba64b701eaa93da67d498f
Instruction Fuzzy Hash: F1D1AB32714A808AEB22CF7AD4403EC37B5F358BD8F548216EF5997BA9DA34C556CB40

Function 00007FF7B880A8F8 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B880AA84

Strings

ty, xrefs: 00007FF7B880A9EE
t, xrefs: 00007FF7B881480A
y, xrefs: 00007FF7B881482C

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen
String ID: t$ty$y
API String ID: 39653677-1920740250
Opcode ID: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction ID: 9969eeaad12e045a87b017ed43eeb7b22423e61e7e0659d368b949abfa48d99c
Opcode Fuzzy Hash: 87489741a1c735bb47c7c7fa151bb2518af881d747d5548b986082c319ae107a
Instruction Fuzzy Hash: 20E11D725087C2C6E7568F38C0143E87AA1EB2AF4CF4C8135CB990B799DBBE94959335

Function 0000000140098930 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000000140098A53
GetLastError.KERNEL32 ref: 0000000140098ADD

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 0064717757fb816ba36e302a15913e1cbdafe464b3098268c38cec24d04983ad
Instruction ID: e0bad62a638c68990d328d5793b8bdc1d639ed9625066bc4d5269d2327d8b571
Opcode Fuzzy Hash: 0064717757fb816ba36e302a15913e1cbdafe464b3098268c38cec24d04983ad
Instruction Fuzzy Hash: D991B1B261065089FB62CF6698807ED2BA0F74CBD8F48511AFF4A67BA5DB34C485CB11

Function 00007FF7B880CC9C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880CD0C
strcmp.MSVCRT ref: 00007FF7B880CD49

Strings

(, xrefs: 00007FF7B8813FB5

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: (
API String ID: 1004003707-3887548279
Opcode ID: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction ID: 94dabf9e697950c76e69a86c816919048374b30b2ab3230f57a4128bdee662db
Opcode Fuzzy Hash: 44ff3ea0eba828e30fde48cf3e6407d113ef1c86855c37323daa94a633f6d87f
Instruction Fuzzy Hash: A3A1A07261878682E715AF29C4043F9A7A1EB66F84F884032CF5E0B78ACF7DD495C364

Function 00007FF7B880BC30 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B8810293

Strings

a, xrefs: 00007FF7B8814EA2
rm, xrefs: 00007FF7B8814EB6
a, xrefs: 00007FF7B8814E9D

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strlen
String ID: a$a$rm
API String ID: 39653677-3573517395
Opcode ID: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction ID: 9adbfd3911a9886e65eff134c8e9bb3d1b2a56ede65b5da16a9419f54562e62b
Opcode Fuzzy Hash: c7bf3fc4039771aa151d5a77072f9711761caae911655a942766ef051505f1bc
Instruction Fuzzy Hash: 7EB142725087C2C6E7569F28C0043E87A91EB2AF4CF5C8135CB890F799DFBE94569325

Function 00007FF7B88F5D20 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF7B88F5DE6
memcpy.MSVCRT ref: 00007FF7B88F5E1E
memcpy.MSVCRT ref: 00007FF7B88F5E70

Strings

basic_string::_M_create, xrefs: 00007FF7B88F5EC7

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 72179817af7f84d4777a76ac889e536a436144b296a5be41eac1759ee4653c10
Instruction ID: 16ddf591df137dba9e0276584d9fd0432a390f2a622047c018f498a4474854b3
Opcode Fuzzy Hash: 72179817af7f84d4777a76ac889e536a436144b296a5be41eac1759ee4653c10
Instruction Fuzzy Hash: 8961E562A26A4592EA15AB19C4042B9E391EF32BD4FC48B31DB1D437D8EF3CE463C314

Function 00000001400BBDF8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBE39
_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBEB9
_invalid_parameter_noinfo.LIBCMT ref: 00000001400BBF0D
_get_daylight.LIBCMT ref: 00000001400BBF65

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: cbe6a422300ce47d191bfdaffd942f57c8d825da7a2edd8825320d75a71d5f2d
Instruction ID: 4cef64af6a6c9a86ce83d0a7878914f71726a3e20492fbdc572d3d8bd7fdd1ae
Opcode Fuzzy Hash: cbe6a422300ce47d191bfdaffd942f57c8d825da7a2edd8825320d75a71d5f2d
Instruction Fuzzy Hash: D7510332604E0287F76B5EABD9013FD66A0E3487E4F198035BB16472F6D7B9CA40CB42

Function 00007FF7B881FE10 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00007FF7B881FF44

Part of subcall function 00007FF7B8826D60: ___lc_codepage_func.MSVCRT ref: 00007FF7B8826D7F

fputc.MSVCRT ref: 00007FF7B881FEB8

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: ___lc_codepage_funcfputclocaleconv
String ID:
API String ID: 1339002523-0
Opcode ID: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction ID: 80d1493028db7d17207ab805f5678f7b4a451b6fcfd3f16cd66835cda06a12fe
Opcode Fuzzy Hash: ce1dac330c6f27128e61fe827faa414519fca3154a38c89fa2bd38bea5801416
Instruction Fuzzy Hash: 3D516073A255418AE720BF29D141369E7E1EB2AB58F944235EB0C4B38DCE28ED52C764

Function 0000000140081E60 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000140081E80
FreeEnvironmentStringsW.KERNEL32 ref: 0000000140081F7B
RtlInitUnicodeString.NTDLL ref: 0000000140081FEE
RtlInitUnicodeString.NTDLL ref: 0000000140081FFB

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: bcdf9e957b836fad2b9a144feaaed0332e88cebafea3e7606a3ee423db221a5a
Instruction ID: 9735953dc97c4c7278c1d0ea2bf846f00a1df3506a1c5c193014c8045fd42382
Opcode Fuzzy Hash: bcdf9e957b836fad2b9a144feaaed0332e88cebafea3e7606a3ee423db221a5a
Instruction Fuzzy Hash: C3518932A18B80C2EB129F16E44039D7761FB98BD4F549215EB9D03BA6DF78D2E1C700

Function 000000014003FFA0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B782C: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400B7849
Part of subcall function 00000001400B782C: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400B786C

std::_Lockit::_Lockit.LIBCPMT ref: 000000014003FFE1
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140040006
std::_Facet_Register.LIBCPMT ref: 00000001400400B2
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140040114

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 5df3add741de15268a4c1c893243a82b2349d0c978b64c86d7b80c97edf7e36a
Instruction ID: bc1c7009bf646980d28510eba16aabbeef68747b7b6e5d2c383e6a03373d8cef
Opcode Fuzzy Hash: 5df3add741de15268a4c1c893243a82b2349d0c978b64c86d7b80c97edf7e36a
Instruction Fuzzy Hash: 12414232210B4082EA16DF62E84479A73A4F78CBD0F591622FB9D077B6DF38C852C704

Function 00007FF7B88E9BF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF7B88E9C7C
memcpy.MSVCRT ref: 00007FF7B88E9C99

Strings

basic_ios::clear, xrefs: 00007FF7B88E9BF4
basic_string::_M_replace, xrefs: 00007FF7B88E9D2D

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpymemmove
String ID: basic_ios::clear$basic_string::_M_replace
API String ID: 167125708-1781676995
Opcode ID: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction ID: d2edbde710f519c517ed686d39aa3e68f79ce87071c00dd12bda330f47981643
Opcode Fuzzy Hash: 9e4550a019cffcd376447f221df9850e9f31bf033150585d54ede76ce84063a6
Instruction Fuzzy Hash: 23310A21B2965582EA207B29D9046B8F6909B72BD5FD44233EF6C077DECD6CE013C358

Function 00007FF7B880C01B Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF7B880C086

Strings

: , xrefs: 00007FF7B880C0C9
, xrefs: 00007FF7B881422B
new , xrefs: 00007FF7B88141C2

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction ID: 5122e325eeb6711a9387a96b6b22c23d553d716c963f981806a41d3fcdacbead
Opcode Fuzzy Hash: 3fc4c2fb453cfd023dde4cb91d12fe7f9a63e258c5c55c3d849b597dfd20e7c1
Instruction Fuzzy Hash: FA41AF72B5474282E715BA1AE8003E9E751EBA7BD4F844032CF1E0B78ADE7CD492C364

Function 0000000140072620 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007264B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140072670
std::_Facet_Register.LIBCPMT ref: 000000014007271B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140072766

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 62bd9740c1c2a61441fbb226ba8157bed7cf0d9f22f07cc03869d12c08925ec8
Instruction ID: be9d38ffdc7b6e85c66b2e680f8457809c6085b235bb2fc594de332f3a9dc2cf
Opcode Fuzzy Hash: 62bd9740c1c2a61441fbb226ba8157bed7cf0d9f22f07cc03869d12c08925ec8
Instruction Fuzzy Hash: 76414736214A8085FA26DF57E8543D967A0F38CBE4F581626AB8E477B6DE3CC542C700

Function 0000000140053690 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400536BB
std::_Lockit::_Lockit.LIBCPMT ref: 00000001400536E0
std::_Facet_Register.LIBCPMT ref: 000000014005378B
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400537D6

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: ee9c97aff65a88c868663459daf74bfe0eb66c434d2bd69df478b3ba643f2863
Instruction ID: 96bec1322d2bd20d32e2a3d0ca8a3050f366ed013bd88369537771368691d56a
Opcode Fuzzy Hash: ee9c97aff65a88c868663459daf74bfe0eb66c434d2bd69df478b3ba643f2863
Instruction Fuzzy Hash: 5B4159B6618A4481FB26DB56E4543D963A0F78DBE4F981622EB8E477B5DA38C4418700

Function 0000000140041CC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041CEB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041D10
std::_Facet_Register.LIBCPMT ref: 0000000140041DBB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041E06

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 430a7c7fba3e6cd772f167e092afeeab044c99694aa112083181d399e8b4a4ca
Instruction ID: d98e3f844eaae0dbb3641ed48c0eccbc43257799aee9a4d2446aa5f2d7179b55
Opcode Fuzzy Hash: 430a7c7fba3e6cd772f167e092afeeab044c99694aa112083181d399e8b4a4ca
Instruction Fuzzy Hash: C2416576210A4081FA269F17E8503D967A4F78CBE4F581622EB8E07BB9DE38C442C704

Function 0000000140071DA0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140071DCB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140071DF0
std::_Facet_Register.LIBCPMT ref: 0000000140071E9B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140071EE6

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f56fe5ed18232deb18e968c14c5c3fe04522fd7049ad61aa0ad3329ac39ecee9
Instruction ID: 66d9cf291a1fa9e9b9738823fb45094ee63abfac6f40b496fa964a1de3cbb30d
Opcode Fuzzy Hash: f56fe5ed18232deb18e968c14c5c3fe04522fd7049ad61aa0ad3329ac39ecee9
Instruction Fuzzy Hash: F9414436214A4081FA269F6AE8547E963A4F79DBE4F481622FB8D477F5DE38C442C700

Function 00007FF7B88BB7B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B88BB7D8
memcpy.MSVCRT ref: 00007FF7B88BB807

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF7B88BB875
basic_string::_M_replace, xrefs: 00007FF7B88BB7B2, 00007FF7B88BB890

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: memcpystrlen
String ID: basic_string::_M_replace$basic_string::_S_construct null not valid
API String ID: 3412268980-2381965344
Opcode ID: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction ID: 000e5a0bd3517947a470c0c333af9d323ad2361a663f37fa9a6cfbae63cf668e
Opcode Fuzzy Hash: 79e987ffc4bcb91b5321d71e7488087a07853e24a2e21d4a92b84586f2bdd09f
Instruction Fuzzy Hash: 2921D221A0AA4685EA11BB1EE4501ADE760AF66BC4FC44431EB4C0B369DE3CD463C354

Function 00007FF7B8825680 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000003,00007FF7B8A9F1A0,00007FF7B88257BF), ref: 00007FF7B88256B5
InitializeCriticalSection.KERNEL32(00000000,00000003,00007FF7B8A9F1A0,00007FF7B88257BF), ref: 00007FF7B88256F8
InitializeCriticalSection.KERNEL32 ref: 00007FF7B88256FE

Strings

*, xrefs: 00007FF7B88256A1

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: CriticalInitializeSection$Sleep
String ID: *
API String ID: 1960909292-3311777216
Opcode ID: 8cc8789fdc81fa29067ac66dfc528fbecfa4c76c3f5a56aee71b84c1566e406d
Instruction ID: 4e3571663c2437e79a311db085b789090eddd44914f885eea135ed8b0a523ab1
Opcode Fuzzy Hash: 8cc8789fdc81fa29067ac66dfc528fbecfa4c76c3f5a56aee71b84c1566e406d
Instruction Fuzzy Hash: 92214421A9D54286E7556B5CED505B8E760AB67750FC94431CF0D82299DE2CE892C328

Function 00000001400B6634 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400B667D
GetLastError.KERNEL32 ref: 00000001400B668B
WideCharToMultiByte.KERNEL32 ref: 00000001400B66C0
GetLastError.KERNEL32 ref: 00000001400B66CE

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 200b3f1345e44cfc852f10eac067f1733b4bc9db33fdb8001f79150db3be88e0
Instruction ID: 6b88c86b770a9c586cb1af37b28efd7b706573da5102e3c4f3865fff8226cb73
Opcode Fuzzy Hash: 200b3f1345e44cfc852f10eac067f1733b4bc9db33fdb8001f79150db3be88e0
Instruction Fuzzy Hash: D0212E76614B94C7E3618F22E44435EB7B4F79DBD4F540129EB8957B64DB39C8418B00

Function 00000001400B6B20 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B6450: GetModuleHandleW.KERNEL32 ref: 00000001400B6466
Part of subcall function 00000001400B6450: GetProcAddress.KERNEL32 ref: 00000001400B6476

GetLastError.KERNEL32 ref: 00000001400B6B44

Part of subcall function 0000000140095298: IsProcessorFeaturePresent.KERNEL32 ref: 00000001400952BE

GetFileAttributesW.KERNEL32 ref: 00000001400B6B53
__std_fs_open_handle.LIBCPMT ref: 00000001400B6B7C
CloseHandle.KERNEL32 ref: 00000001400B6B8E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: a30d72a7a7c29de0c40d55f3abdf60503d6325bd51d8adae0c4a333c6577edac
Instruction ID: 818140f3fab44495a555ab8a09c83194e8e23688ba8165b1c45cae0150ad504a
Opcode Fuzzy Hash: a30d72a7a7c29de0c40d55f3abdf60503d6325bd51d8adae0c4a333c6577edac
Instruction Fuzzy Hash: D6115132A14A4045EA565FB7A5847AA6671E7887F0F140614BB77C7AF5DF3CC4818B00

Function 00000001400AAB48 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400AAB74
GetCurrentThreadId.KERNEL32 ref: 00000001400AAB82
GetCurrentProcessId.KERNEL32 ref: 00000001400AAB8E
QueryPerformanceCounter.KERNEL32 ref: 00000001400AAB9E

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6fe15b0c4e384d37091185729348d816b74690dfa4f443000fe0a912ec8efaa2
Instruction ID: 7d6ebf1f97da6684202fd37eb3c70f695ff936aad7ae610a3630038643fe83ba
Opcode Fuzzy Hash: 6fe15b0c4e384d37091185729348d816b74690dfa4f443000fe0a912ec8efaa2
Instruction Fuzzy Hash: 38111532751B008AEB008B62E8543A833A4F71DBA8F441E25EB6D877A4DF78C1A58350

Function 00007FF7B8802590 Relevance: 6.0, APIs: 4, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strcpy_s.MSVCRT ref: 00007FF7B88025BD
strcpy_s.MSVCRT ref: 00007FF7B88025CA
_strlwr.MSVCRT ref: 00007FF7B88025D6
_strlwr.MSVCRT ref: 00007FF7B88025DB

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: _strlwrstrcpy_s
String ID:
API String ID: 3746470816-0
Opcode ID: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction ID: e30748ed539c7d1e61d913905733a7fe04082f4356b91869a9333246b0a0132f
Opcode Fuzzy Hash: 39eff12b834902331b533afb545837a96e33ccd5846002bbcdcfc94689f971a5
Instruction Fuzzy Hash: C6F0EC6131468686FE11AB23BD007A983099B96FC0F8C00328E4D17B98CC3CE2878308

Function 0000000140054F60 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 402COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005523A
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400552CB

Strings

invalid hash bucket count, xrefs: 00000001400551B1

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: invalid hash bucket count
API String ID: 118556049-1101463472
Opcode ID: cad2b4398f93dfe1a3b7e2b10d8947fc51ed9edd09650b80b454307351c134c9
Instruction ID: 7dc8a75d286ccf3bbeaf8c8748fc2d8b425e50115ec36ebcf79158fb8b88f763
Opcode Fuzzy Hash: cad2b4398f93dfe1a3b7e2b10d8947fc51ed9edd09650b80b454307351c134c9
Instruction Fuzzy Hash: 70F17C72201B8482EB55EF12E46039D73A4F74CBE4F588526EFAD47BA5EB39C4A1C340

Function 000000014002E800 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014002E93B

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 9d10d5961e257bc83ab52ab9107e09406af5a259c6370344c7be281104fa34b5
Instruction ID: 9bfa3acb795d48fbdc46d00a55fcaaa28ed1048c95eca48bab4ec83af28bcc05
Opcode Fuzzy Hash: 9d10d5961e257bc83ab52ab9107e09406af5a259c6370344c7be281104fa34b5
Instruction Fuzzy Hash: F771F172B10B9085FB01CB7AE4413DD37A1E799BD8F54421AEF9917BAADB78C482C340

Function 0000000140072BA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140072C0F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140072C57

Strings

bad locale name, xrefs: 0000000140072D2C

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 8e48b185d2ad377adad793cb0c2e61843d436bf41b4dc4ce2b229c4423d5b721
Instruction ID: b919e2adb03058459a08787be6f33273e8fd86740414413052806a2770abb456
Opcode Fuzzy Hash: 8e48b185d2ad377adad793cb0c2e61843d436bf41b4dc4ce2b229c4423d5b721
Instruction Fuzzy Hash: A8514C33311A408AEB16DFB2E4907EC33B4FB58B88F044425FB4A67AA5DE38C955D344

Function 0000000140054420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014005448F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400544D7

Strings

bad locale name, xrefs: 00000001400545B6

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 80a5ced4145d21076f0491c6eeec770f45411c69c219c7bb2cb606199f338d71
Instruction ID: e6e463b9e1f652434f87afe0abaeb0bd7d36a5076df94eceddc511b98dd6a078
Opcode Fuzzy Hash: 80a5ced4145d21076f0491c6eeec770f45411c69c219c7bb2cb606199f338d71
Instruction Fuzzy Hash: 96513B32312A408AEB16DFB2E4903EC33B4FB58788F044425FB8A67AA6DF34C525D344

Function 000000014009DEBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A3264: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A3297

_get_daylight.LIBCMT ref: 000000014009DFD4
_get_daylight.LIBCMT ref: 000000014009DFE5

Strings

?, xrefs: 000000014009DF65

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: dec6d37dbd22f3a85d6b35a17a0feec669fea7c16c8a71b63241f9b5b8fbd9dc
Instruction ID: b0c4c4f40001a5467877201c390160bb1bb914dd2c4e957f28464d23d5666058
Opcode Fuzzy Hash: dec6d37dbd22f3a85d6b35a17a0feec669fea7c16c8a71b63241f9b5b8fbd9dc
Instruction Fuzzy Hash: 0E41F83221478046FB669B27E5563FA67A0E798BE4F144226FF5947BF5EB38C881C700

Function 0000000140098600 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000000140098717
GetLastError.KERNEL32 ref: 0000000140098739

Strings

U, xrefs: 00000001400986C3

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ff9670a3bdeea2dc0e04f94de2162aa67abd2fa7127bffc9359cf981a8e8ed7c
Instruction ID: 8e4ab516b8a29dfabae5ee0ef9a54c4ba7fa48e80f278cd7ab75898e171abe9a
Opcode Fuzzy Hash: ff9670a3bdeea2dc0e04f94de2162aa67abd2fa7127bffc9359cf981a8e8ed7c
Instruction Fuzzy Hash: D841B332715A8086DB218F66E8443EAA7A0F79CBC4F904125EF4D877A8EB3CC441CB40

Function 000000014009D258 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 000000014009D2AC
_set_errno_from_matherr.LIBCMT ref: 000000014009D319

Strings

exp, xrefs: 000000014009D287

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: f45fae9e3f71500e5b5a591dcf295bfd7ffd6db6b8f160502000cbe5d4a7ff26
Instruction ID: f5d0c8a78a0e6a8a4dd1fb3f21a071c67b80d90b3824bfa811f874e6c851eba2
Opcode Fuzzy Hash: f45fae9e3f71500e5b5a591dcf295bfd7ffd6db6b8f160502000cbe5d4a7ff26
Instruction Fuzzy Hash: 24212236A10A148EE751CF7AD8813EC33B0FB5C388F401626FB0AA7B5ADA38D5418B40

Function 00000001400AC0C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400AC118
RaiseException.KERNEL32 ref: 00000001400AC159

Strings

csm, xrefs: 00000001400AC146

Memory Dump Source

Source File: 00000001.00000002.1896459053.0000000140000000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_140000000_phantomtoolsv2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 2d42cdfcb1ff534642483aeaeae706dda7279a24a451ff2176392dab70bf652b
Instruction ID: 7f42a9847f84888bb00b0fd94d9c5d46f3abea2284a8759a76045259342b16a3
Opcode Fuzzy Hash: 2d42cdfcb1ff534642483aeaeae706dda7279a24a451ff2176392dab70bf652b
Instruction Fuzzy Hash: E411FB32214B8482EB628B16F44079977E5FB99B98F594225EB8D07769DF3CC591CB00

Function 00007FF7B881A420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Unknown error, xrefs: 00007FF7B881A50C

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction ID: 3f889e3ac87623ed78a611fc70f7d890d33ea12766c05bb439bdc7913b6e7a15
Opcode Fuzzy Hash: 194a6ffba7f098d6450882ceade0846a3a5d892eff98fad5ff52d12c8e674ac6
Instruction Fuzzy Hash: 9201E562919E84C2D202AF1CD8411FAF374FFAA75AF645321EB8C26264DF29D553C704

Function 00007FF7B881A4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Partial loss of significance (PLOSS), xrefs: 00007FF7B881A4D0

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction ID: f2432d1bf54d572cf9840d31791f9a7637f2d6232bfb5de2b3d4112598f149c7
Opcode Fuzzy Hash: ae991bd237688d46af379bc9e2c88ae6c4cf7060aa663ad11618093b77570e75
Instruction Fuzzy Hash: 0EF0AF52819E8882D202AF1CA4000ABF324FF9E789F681325EB8D26168DF28E5438714

Function 00007FF7B881A4C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Argument domain error (DOMAIN), xrefs: 00007FF7B881A4C0

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction ID: a304c2a7c3383c22e66033ed15dbd16ddcbc8f45ac3130a88a2204468fde1acf
Opcode Fuzzy Hash: 11d2b9735bd3709252506aa5ba5fa1e351431b4c673cdd365ea37068437d7b3c
Instruction Fuzzy Hash: 12F0C252919E8882D202EF1CE4000EBF374FF9E789F681325EF8D26168DF28D5438714

Function 00007FF7B881A4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7B881A4F0

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction ID: 47c98e2b87dfd7b212ccef89f7740a3053a11abf697651173c76498833394039
Opcode Fuzzy Hash: 62e2639ade3852005c6560a781b013c3a86ab195a2881249103c75c778e9902b
Instruction Fuzzy Hash: A7F0AF52819E8482D202AF1CA4000ABF324FF9E789F681325EB8D26168DF28D5438714

Function 00007FF7B881A4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Overflow range error (OVERFLOW), xrefs: 00007FF7B881A4E0

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction ID: 991735c550df227ff58a0fe34e4c697c695971ed2343a7135e675d856cb5e6d2
Opcode Fuzzy Hash: 011e2c0bcc3796c487ded507d96121c6e9820a89f73ee2ebf114777c49236ea0
Instruction Fuzzy Hash: 9FF0C256819E8882D202EF1CE4000EBF374FF9E789F681325EF8D26168DF28D5439714

Function 00007FF7B881A500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Total loss of significance (TLOSS), xrefs: 00007FF7B881A500

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction ID: 7cbcaeb4c041705d94570af20f1bd40bc1cb4ab3b74e58ad93d5983b38a79c46
Opcode Fuzzy Hash: 22cc9ee71a5ffac9a6ca83f9a2c6e26604571fd27d9318c0ebbd99beaa658a45
Instruction Fuzzy Hash: 1BF0AF52819E8482D202EF1CA8000ABF324FF9E799F681325EB8D26168DF28D5438714

Function 00007FF7B881A458 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B881A4A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B881A487
Argument singularity (SIGN), xrefs: 00007FF7B881A458

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction ID: d9414889897181edb48c86ac07903b5a4de699689b73277313565bf6fe0c4944
Opcode Fuzzy Hash: a7c664df915d4e69880d0547989fba806fe34be971c47809b57ea1152bda214e
Instruction Fuzzy Hash: 72F06256915E8882D202EF1CA4000ABF364FF5E799F545325EF8D2A164DF28D5438714

Function 00007FF7B8801294 Relevance: 5.1, APIs: 4, Instructions: 80stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF7B8801312
strlen.MSVCRT ref: 00007FF7B8801334
malloc.MSVCRT ref: 00007FF7B8801340
memcpy.MSVCRT ref: 00007FF7B8801358

Memory Dump Source

Source File: 00000001.00000002.1898493187.00007FF7B8801000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7B8800000, based on PE: true

Associated: 00000001.00000002.1898459464.00007FF7B8800000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898606710.00007FF7B890F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898697621.00007FF7B8911000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898825458.00007FF7B8AA0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1898853129.00007FF7B8AA4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7b8800000_phantomtoolsv2.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 4ee85fb58601ac7611963cd66a25d646a980d7074b0776cdd030191079d3958a
Instruction ID: 517c292c76a2f95ecb518a089f383652a8b04a73aef38b547042cb0784babe93
Opcode Fuzzy Hash: 4ee85fb58601ac7611963cd66a25d646a980d7074b0776cdd030191079d3958a
Instruction Fuzzy Hash: 8A31A129A2E64686E711BF5DE851774E3D5AF63790FC44038CF1C07399EE2DA426C728

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report phantomtoolsv2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\phantomtoolsv2.exe:a.dll

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
phantomtoolsv2.exe

Function 00007FF7B8803C70 Relevance: 40.6, APIs: 14, Strings: 9, Instructions: 376
libraryloadermemoryCOMMON

Function 00007FF7B88034D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 298
COMMON

Function 00007FF7B8803060 Relevance: 7.7, APIs: 5, Instructions: 231
stringCOMMON

Function 00007FF7B88011D9 Relevance: 7.6, APIs: 5, Instructions: 91
COMMON

Function 00007FF7B88046A4 Relevance: 4.6, APIs: 3, Instructions: 128
processCOMMON

Function 00007FF7B8803539 Relevance: 6.0, APIs: 4, Instructions: 48
fileCOMMON

Function 00007FF7B8801294 Relevance: 5.1, APIs: 4, Instructions: 80
stringCOMMON

Function 00007FF7B8801289 Relevance: 5.1, APIs: 4, Instructions: 74
stringCOMMON

Function 00007FF7B881B690 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Function 00007FF7B890AB80 Relevance: 1.3, APIs: 1, Instructions: 15
COMMON

Function 00007FF7B881C1E0 Relevance: 33.1, APIs: 11, Strings: 11, Instructions: 88
stringCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre