phantom_stealer | c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
velogs.exe
Size 733KB
Sample260804-txazwavcpb
SHA256 c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31
MD5 c67f0473eae2e790676584b108e7ed73
SHA1 b14b5b72fb8314c14c5fa5e9046802b4202f3175
SHA512 bbed3f0f360ac56863d1429f11a4b4c2e9c98afa4cb971d9f7d1a561cf79c97fdf7ddd5d7831a77e769e029aa0e78a07e96202e4258e289450df9f7624406fdf
SSDEEP 12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn
TLSH
T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection costura discovery phantom_stealer packer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral1/memory/60-0-0x000001FB2CDC0000-0x000001FB2CE7E000-memory.dmp	family_phantomstealer
behavioral1/files/0x000900000002438e-7.dat	family_phantomstealer
behavioral1/memory/2852-40-0x0000024E72910000-0x0000024E729CE000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
2260	velogs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\velogs = "C:\\Users\\Admin\\AppData\\Roaming\\velogs.exe"	velogs.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
40	icanhazip.com

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x000900000002438e-7.dat	costura
behavioral1/memory/2852-40-0x0000024E72910000-0x0000024E729CE000-memory.dmp	costura

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4396	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	velogs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	velogs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
60	velogs.exe
60	velogs.exe
2852	chrome.exe
2852	chrome.exe
60	velogs.exe
60	velogs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	60	velogs.exe
Token: SeDebugPrivilege	2260	velogs.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
60	velogs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 2852	60	velogs.exe	88
PID 2852 wrote to memory of 2476	2852	chrome.exe	89
PID 2852 wrote to memory of 4972	2852	chrome.exe	90
PID 2852 wrote to memory of 4396	2852	chrome.exe	91
PID 60 wrote to memory of 2852	60	velogs.exe	88
PID 60 wrote to memory of 2852	60	velogs.exe	88
PID 2852 wrote to memory of 460	2852	chrome.exe	92
PID 2852 wrote to memory of 3768	2852	chrome.exe	94
PID 2852 wrote to memory of 3928	2852	chrome.exe	95
PID 2852 wrote to memory of 1264	2852	chrome.exe	96
PID 2852 wrote to memory of 2960	2852	chrome.exe	97
PID 2852 wrote to memory of 2136	2852	chrome.exe	98
PID 2852 wrote to memory of 5108	2852	chrome.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

C:\Users\Admin\AppData\Local\Temp\velogs.exe
"C:\Users\Admin\AppData\Local\Temp\velogs.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff802ecc728,0x7ff802ecc734,0x7ff802ecc740
    3⤵
    PID:2476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,6403500833551353022,13649983378142787234,262144 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=1788 /prefetch:2
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,5629941307902479774,3985774065308946719,524288 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,9134181337760098297,10052660928280704451,524288 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
    3⤵
    PID:460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,6933956858193773634,8229606155877788527,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,4248985586611922186,12841768369220339278,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3376,i,13794090436617177235,1802888657283063195,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3400,i,11388664635288738773,12660336863671859883,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
    3⤵
    PID:2960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4316,i,965310383254637999,2059527213980435904,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=2768,i,10725836596138278710,12146314019459055454,2097152 --field-trial-handle=1676,i,2378568855750178128,5676252061673870237,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:2
    3⤵
    - Drops file in Program Files directory
    PID:5108

C:\Users\Admin\AppData\Roaming\velogs.exe
C:\Users\Admin\AppData\Roaming\velogs.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Crashpad\settings.dat
Size 40B
SHA256 fca1111982eba4fbd219800e48a73f4bb957fbcddf85a61e831cd775d463a4e9
MD5 9827ad8b673b50818eddae7e47460da1
SHA1 c09d109ec3b1bd1328fced60c7ecdc889c5ff3c4
SHA512 515a6046e07bf9a126b565837342ae7e007857b908549af489d614faf9fd3a546806143311d7bce27613a65efc4e95abad01e1401c50794391c589acf734317b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c5369be5fc3277cc5bd138e84a67deba714a7766b29e0abfcf2e84c0086ad074
MD5 08fba968c4b888dfd752b8d5abd17678
SHA1 553d0c73e4004511a27b872d22e0856e9bf9bf6d
SHA512 0ab49bceb1942710d6aa90e88966da1bca3ecd7c64857467f9879267037cc3a92837a88cb7a3acb554ba4443e7ef535b11272c6c61034a5a2602a2a9471be778
SSDEEP 3:MsFlthltlluQEGtBxkkellx73011VEkpN1S5d33qqC+elL/l:/F8yskeB31C+el
TLSH
T1F7138CEE80D2DCD1C103CDF2405377B00B386930CE63E22381282317E8083AE0788200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 bea101ff4d6b8859ecd9bf0d4e8603416134a01afd5bdf34c141322216fb2e42
MD5 772ab4c1e26ce552024c19da506b3ab7
SHA1 72c6be66bbf94d0d6b1e219d56cf1f20106db7c9
SHA512 f8bd807fdc740bf9df17d128152d9f57a0873e079b9a5e6aed8390fe4d19d791efa491d920f4305c8234b3c0bd4b2462c9b6312a27af50550899d6e49765c20a
SSDEEP 12:U/9/IDapqp9iAHCyqaLpqp9ikpKVBpqp9iAZY/RpWpqp9i:GQCLa5mYZp
TLSH
T1E64490F73810D19BC722E3F50110323C9837921C5DDEDEDED5280AB38484E6A54A49A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Cache\Cache_Data\index
Size 256KB
SHA256 98ae3fb1a97aa1309be4b4efef94cf6e49527f15e89d90e2e44e8292eb80a13e
MD5 cf5ae82cce9a8563dfcb2fc2c926560a
SHA1 f298e5989b3f5148fbbe402123c8fce47ca2901c
SHA512 d8882d2682dfd136037b38f41ac594861b866baba18d521e76b6007f80b9b6ecc944cb06e03457196ee068c1018a8ed375704691ccfe1380a774eb8bd05c6f39
SSDEEP 3:LsYllOlNllklkXl9eJll8ncNtlNlXlwlJNtl:LsL3lP9GNm
TLSH
T1D644026FC3D18C45C9D111BCD40B87601B28C424C50FC34753483A243EC27900E0D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 eec45128a4cf2e93b6b2303ec634e4f13eadf4874508674637f23b3d8bb11875
MD5 9e59d67a74931b97104a1f335aa610b6
SHA1 12d77df57c490680995e44ad798fc775e90ff5af
SHA512 1322b73bc6c077e55d8dae3746f6fec44c51a4299e5916cef7d5168a24ffe8d644eaa787a58369eb83790fc394856ce5b0c5bc3bc0f24e78a3aacfc70100d3ba
TLSH
T126E02B91824C0F0DD32D96F7CDB603444B0A83C42ABE3603B8C1C2C1731283412C8123
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 6f16a678373e5110e3e5c1a45e50aa628394f56f1c961d367aa4d897ac5eb9ed
MD5 4664b9363fcbb6a6a61d3cb6dd8f34d1
SHA1 3fd923c56fa5272cf9966e610a0c45b06afe2437
SHA512 f23b4307df421b77568cf94e8a81c849c8c5a7fc6af0aa9a61af94bb27a880c0685e8f2f596fc6117ec09df08b79124975caf40456c3af63a337d673b528f54c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d46fe34a6db17229379ab275414d2c22543df000483336e45bbc0a5a7d8671d9
MD5 ae582c81c4cd786ccc859d78983110de
SHA1 ca35919e72b4f8fb88deb776bb833aac9b369a77
SHA512 b2ac2fbd1494b248bb0fc1c7c3406128df1fe0795c899a1bda9cf0eb51650f1a03c59f5c276b1c7374080370f74134f7a0ff240c0f8dbd75ea4a0b8d6717e203
SSDEEP 3:LstlNllklkXlTT+l:LsX3lPTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\DawnWebGPUCache\index
Size 256KB
SHA256 469edeb49dd7768777969121a864e2786598a36b13218e730320a70bc5ea3538
MD5 959b9a8a5fb4dbe05925adb97ae3fe10
SHA1 2afc1cfdfd79c6466ff3a311c6aa73133503c6e6
SHA512 dab50f3ed68d1347bdafdf72001fcaf0034aff1239218a7efddaa4038cfc3b691d230f0c10ed4671f6985c6015ff53c6f66e1c11832c6318839ed9d0889d4949
SSDEEP 3:LstlNllklkXlXl:LsX3lPX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\GPUCache\index
Size 256KB
SHA256 e3183eda5a8e93881992ef3dc263fe2c9823ebfb707187458224cc315f7e13cb
MD5 9c7dad128a9d910a39ce973b11fac5d4
SHA1 da4f5579089584aefe167fa7b6bb0198f8365dae
SHA512 1b05cb1cfca01e1131f3c1d4d6ba33cef98ac601a973d25b4e06b81c302657226b190f3604094ed07d442832f1036ea26481631ca68a2164ae2eaca06884b9f0
SSDEEP 3:LstlNllklkXl9N:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Preferences
Size 3KB
SHA256 5b61cb6a33e9a7c49102f2d960a69fd21f092fe14ee8cc9dda74f4114a4ce34e
MD5 113fddc12451ac2e71fdcdffad26ec96
SHA1 19500b5296a43149945883538027d9c2c06a0415
SHA512 efa86e3a3bf511eaf4dbcad8a18e3271d10a47c68034ee3d7901cd138660914be182132d5f9bdba6d2c3a20b2d246cf41ed718827a4c00a46a23c10bb038b92a
TLSH
T1F861639AC4B48DAB0DB26B75B4390B82F951473F65921446393E05CD8FB397B8040FAA
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d0fa66f36dfaa09b38a78b8c415506093474598d32b7cee90335c7680abe0e74
MD5 2cced2a1f8b4c0ea2541efd3d8c833f1
SHA1 40de3b06dc553f777e25510e836d7c29fe56da1c
SHA512 ed16897716de2b7c548b7a30a499b0d7b72040a7602184e204484c0e3bc8a185da051590aa24c59493b5bc38842e71cf5ae29cd01e301d03cabe3a69199baadd
TLSH
T10FA002510681D1D0C24082B82801D3891704F9358110031376D22B8B8C740548915184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 b72e51d8214ca9311b5731cc38f29a21b00d9086ee88ec2f5964420e500b83bb
MD5 6d71f49f9318116c8c99489437746cea
SHA1 f98665d88a722e838ffb624c4ccd1c3beeecf545
SHA512 a10fd26362847c3682cb36f51bccc7dd759e494b0555e68ead9d1b4e1de3ddda1cdee48e09cd591edfe4c5ca2376fb8b3cf85f0549421ee938dcda080a49c66f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GrShaderCache\index
Size 256KB
SHA256 f06aece92b3db6ba8a38ebc9f843a2e27dbf81a954f730ab07e6741f0ec4e469
MD5 ad5099fafe5023660c205631668ff145
SHA1 8d9ebdddd294ca5c94c448e92845c2b0acb1cb28
SHA512 bb19bd61f22ec4362dc822eeafeb1d64e441c79959d99f08223e5d61ba3754a331e8e99a3c807c6e5be04dbc64c6b9250723b399bb7e84b0639336ba1b9451cd
SSDEEP 3:LstlNllklkXl+Gl:LsX3lP+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\GraphiteDawnCache\index
Size 256KB
SHA256 945b6a28ce29edca7020b5dd3d19514b178f22041e9b56506f2b6098a033a041
MD5 ee1bed2d862b2ad50b7a622eeaa9b258
SHA1 d1ee0eb4f208aaf20b65c8fa16a39ed6eda751bd
SHA512 40878cb8ff4961f9ef901f4c6ac23d662e75f8395058c36169751ce578ecece05a62cffec456f7a318245e4bbc197b989fbe9651c978c089425ad62e93c9aa56
SSDEEP 3:LstlNllklkXlg:LsX3lPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\34vvmeyx.mlg\Local State
Size 1KB
SHA256 3ec492a5a3179278002f5ff9c88879463badb7533b3999516c157a687bce3125
MD5 5b2594ab9d941b0ab21410cd3ba7e03a
SHA1 a1479f45512674b629d4464b00ac5570b37b3be0
SHA512 c21b340d28f324841069587d6aa5fa2b85dc264d0449a5dc94c2f044c0973c11d0686f3b4af737d0de29bee17dccdca8ef83a60c4f7e147b9bb8cb2cfc6cf7f2
TLSH
T16711757166287261B942079BB8D5A7E70F3AA32AC0E2DD3E16DE146401F638C3302E34
MD5 SHA1 SHA512 TLSH

Submit Download

velogs.exe

Path C:\Users\Admin\AppData\Roaming\velogs.exe
Size 733KB
SHA256 c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31
MD5 c67f0473eae2e790676584b108e7ed73
SHA1 b14b5b72fb8314c14c5fa5e9046802b4202f3175
SHA512 bbed3f0f360ac56863d1429f11a4b4c2e9c98afa4cb971d9f7d1a561cf79c97fdf7ddd5d7831a77e769e029aa0e78a07e96202e4258e289450df9f7624406fdf
SSDEEP 12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn
TLSH
T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-191-0x000001FB2EC50000-0x000001FB2EC72000-memory.dmp

Download

memory/60-0-0x000001FB2CDC0000-0x000001FB2CE7E000-memory.dmp

Download

memory/60-15-0x000001FB2EB40000-0x000001FB2EB5E000-memory.dmp

Download

memory/60-14-0x000001FB488C0000-0x000001FB48DE8000-memory.dmp

Download

memory/60-13-0x000001FB47FF0000-0x000001FB48040000-memory.dmp

Download

memory/60-12-0x000001FB48070000-0x000001FB480E6000-memory.dmp

Download

memory/60-11-0x000001FB481C0000-0x000001FB48382000-memory.dmp

Download

memory/60-6-0x000001FB2EBA0000-0x000001FB2EC52000-memory.dmp

Download

memory/60-1-0x000001FB2EB30000-0x000001FB2EB40000-memory.dmp

Download

memory/60-194-0x000001FB2EB30000-0x000001FB2EB40000-memory.dmp

Download

memory/2260-9-0x0000020999970000-0x0000020999980000-memory.dmp

Download

memory/2852-40-0x0000024E72910000-0x0000024E729CE000-memory.dmp

Download