phantom_stealer | c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
velogs.exe
Size 733KB
Sample260804-txazwavcpb
SHA256 c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31
MD5 c67f0473eae2e790676584b108e7ed73
SHA1 b14b5b72fb8314c14c5fa5e9046802b4202f3175
SHA512 bbed3f0f360ac56863d1429f11a4b4c2e9c98afa4cb971d9f7d1a561cf79c97fdf7ddd5d7831a77e769e029aa0e78a07e96202e4258e289450df9f7624406fdf
SSDEEP 12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn
TLSH
T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection costura discovery phantom_stealer packer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 3 IoCs

resource	yara_rule
behavioral2/memory/936-0-0x0000012BD9C20000-0x0000012BD9CDE000-memory.dmp	family_phantomstealer
behavioral2/files/0x000d00000001c5af-11.dat	family_phantomstealer
behavioral2/memory/5384-136-0x000001C125D30000-0x000001C125DEE000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
300	velogs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\velogs = "C:\\Users\\Admin\\AppData\\Roaming\\velogs.exe"	velogs.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c5af-11.dat	costura
behavioral2/memory/5384-136-0x000001C125D30000-0x000001C125DEE000-memory.dmp	costura

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
980	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	velogs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	velogs.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
936	velogs.exe
936	velogs.exe
4356	chrome.exe
4356	chrome.exe
936	velogs.exe
936	velogs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	velogs.exe
Token: SeDebugPrivilege	300	velogs.exe
Token: SeShutdownPrivilege	4356	chrome.exe
Token: SeCreatePagefilePrivilege	4356	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4356	chrome.exe
4356	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	velogs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4356	936	velogs.exe	92
PID 4356 wrote to memory of 5384	4356	chrome.exe	93
PID 4356 wrote to memory of 4488	4356	chrome.exe	94
PID 4356 wrote to memory of 980	4356	chrome.exe	95
PID 4356 wrote to memory of 2480	4356	chrome.exe	96
PID 4356 wrote to memory of 1100	4356	chrome.exe	97
PID 4356 wrote to memory of 1888	4356	chrome.exe	98
PID 936 wrote to memory of 5384	936	velogs.exe	93
PID 4356 wrote to memory of 4556	4356	chrome.exe	99
PID 4356 wrote to memory of 1800	4356	chrome.exe	100
PID 4356 wrote to memory of 984	4356	chrome.exe	101
PID 936 wrote to memory of 5384	936	velogs.exe	93
PID 4356 wrote to memory of 5520	4356	chrome.exe	103
PID 4356 wrote to memory of 2384	4356	chrome.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	velogs.exe

C:\Users\Admin\AppData\Local\Temp\velogs.exe
"C:\Users\Admin\AppData\Local\Temp\velogs.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc7139c728,0x7ffc7139c734,0x7ffc7139c740
    3⤵
    PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1680,i,2703230663261526843,5793392513107845374,262144 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:4488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,8928989280364606482,3418001073680052213,524288 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
    3⤵
    - System Time Discovery
    PID:980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,15509877544641111299,7086320362350089736,524288 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
    3⤵
    PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2952,i,11854296819955750243,7892567845973484568,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,2873087213876981256,13950944546043204686,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:1888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3180,i,8673076125580150728,12525051688968588959,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3192,i,10269582936328124313,1058176381599419510,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:9
    3⤵
    PID:1800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3772,i,8126317030238564120,8508287580312083665,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
    3⤵
    PID:984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4272,i,12290747786887362504,14743963435745601949,2097152 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx" --force-high-res-timeticks=disabled --metrics-shmem-handle=4316,i,17408600968773364633,2781594290163073076,524288 --field-trial-handle=1896,i,10584515195425641428,13532721016397206576,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
    3⤵
    PID:2384

C:\Users\Admin\AppData\Roaming\velogs.exe
C:\Users\Admin\AppData\Roaming\velogs.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Crashpad\settings.dat
Size 40B
SHA256 a8d5e64e56758fe92eca0b76bec7ef92a74f6adaedb89ea99650692784abcbf6
MD5 d75c884f0a09c383453f3db04cbbf8d2
SHA1 cc510036a9b85f769dcbffbf2d021d752f5b161a
SHA512 c596369d9d0232ccb9a6533d7ae5a39ac093b6cd6ea8dfce9edb935996526403574c964b0669d405124fffa98a3654f61dbc06ce660c384e104dbf02e88cc766
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ed7d19b645dea402f5c76157cf40821d7211f9981254bd3a1ccbefec385296b4
MD5 addbf7171f76dee218d3215431347b8a
SHA1 ac7e772589af32d199143e41098b39123df17806
SHA512 833671ec97869407eb391ffc987854871a1034c41941b36459e683e9ef9cc32ab7faab06f7b4402119037e871e23a74a61d680034388b3d5b10ff2dab07609d2
SSDEEP 3:MsFlthltlluHWCTekflcgT20TWCTI1VLrpNXnT+E1ll1sxOflovxlmi+elyW:/F82lkNcTJ3v/Novjmi+elyW
TLSH
T1E4134CFEA54DDEC7C5C9143D894B9A7C427294709B295A6392E02721F68975E0008111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3ad08d9a479e104f47f32af0f7b33faaf47fd0a6afe7a78576e7c95accd05cfa
MD5 70da12e60079e8a9dae93be5514e9f57
SHA1 e3ded82ec4d5a78b2231f7d81dd5bfb0e9268060
SHA512 ccf8491e8ab66340c7e1430e9c4f897fc98c8be65d6464f9589bec85824a1609088fdb31ba8a4161278bfac41839547305852a95caaba7bf82a589cf88635e4e
SSDEEP 12:U/7Neflkyjpqp9iki6IN9+pqp9iRrvpqp9iAZY/uGxpqp9iAHCmkl9G6ez3lk3zq:gNolkyd9N9/YGVCmkf2lk3z/mizblQZ
TLSH
T15E44BDE37800429BDB14D3F80140723C8A3391193DEECDEEF4A825B39144FA560A85A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4791dcbe13a324721059d36efce97aacdb85daa493e5919c2ef793328c211994
MD5 f14c8951f7217ba47bbe76c87f85a255
SHA1 5ca4da4d9d5062d7c52394ed21f0061eaf70c328
SHA512 8358a90a04abf1c142e19528041ce564b09e41ccec29d1eac409fac836ed895f61c86511a414cfdea4d3844e33e067f9c8f1e2103583cffd3565777c3fdb1fe0
SSDEEP 384:lUfDPLGRgcRUv+BFcS+hYgUfDPLGRgcRUv+UFcS+hY:lUfDPLSgcRUv+/4LUfDPLSgcRUv+E4
TLSH
T190162CB64F64B98BD781EEB0ABC8DE183CB122D9EC925C91F52153594BD0FC41BC121D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Cache\Cache_Data\index
Size 256KB
SHA256 4afc0a87b376e2b92882055ddb7ada542d3cc41678029450d7267f86e2bc2f11
MD5 2e4ab5993ba66b492d4a3cb0bcd9cd81
SHA1 6837572a7c9de1b73a8b2ca3cddc97c1f50fed83
SHA512 4641aa050cb5cee5c8cd32e8a6e2be5f28ad7b0d8b3eee7222efb68d53a5a1e5431a07f5fc6686d654981bd1a5d8a7743774d9490a0ada6aab423ef9f26bada1
SSDEEP 3:LsYllOlNllklkXlbimltbllV11EjNtlmNtlwlNlXl:LsL3lPTltGkN
TLSH
T1F044026FC7D18C47D5E0037CC69787A51328D454C61FC34B03155B307DC17940E1D844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 baf43611b4709eae1b2b22034d7aff6722ffe2b2bab801b30645a86e950f6954
MD5 188c2e92d0f7d9852dd7eeebb035e90c
SHA1 1282be0519fad55c0968baad408180b51cc6fd34
SHA512 65d6c52351410c174c8325f84aebb42de0494c691df59e34efb4d1cb31a65e69166b1fecb006b4f2f459795ed1727444ca257e88384dcbc4780740ac742f0b57
TLSH
T19DE02B85C24C0F0DD33DA6F7CDB703044B1A43C429BE3A03A880C2C233128281298223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 cf37583bc8b2604352898e1985698dd39fc77a80d0b26e4655073df2783de7b2
MD5 30f31896e99d8b818d518b3383339847
SHA1 1bf8d50dacee225088d1b85fb19b541d27a9d847
SHA512 d97fce81eb41459b1fa8c892041d44adb31eae8327fa65c752fb573f173524d87df1b80120399d393c85eccb8575a305b7e5c41b50241e558494d817089a9a8d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d719f07d144c793b96842ee4514042d802fa43d17b8012b2e281f8657a4375ba
MD5 c33696cacc77c6a7b12fb55ddc87facf
SHA1 574792f31bc4e1b53b55e4fd7f12491c3646533f
SHA512 4a660ad2eb2b616dc7124ee1545114605f0dbac8d55f00e9aefff0dc4fec1ec0c340b8cc09e9c3b565a2bf587fc8eade720e9022d3b3507a0937eca76759b4df
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\DawnGraphiteCache\index
Size 256KB
SHA256 bf5a6e022ca5b647c43015f4166be87983ac503ccb5822bce8ccbc3ae0d2ec69
MD5 d784b6c783845f7c40e46b70f00042ce
SHA1 97e481f333e0d7c15971c83fb8fe2e57f7388819
SHA512 383acc30e96c55b1489be033832c90bced88402fe9c167ed753aca2d0cba6493a9434ec752082daed0cfd9a56881b1b0a47bd32069da1648928df8542fed8ed8
SSDEEP 3:LstlNllklkXlJT:LsX3lPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\DawnWebGPUCache\index
Size 256KB
SHA256 204e6538fadb371d24d6f07ab6d15015988abedd6fbf1d969ab5ec12b68f2f91
MD5 d7f1009a5b4ba816ca985a1b6c66b210
SHA1 1a1b8dc474903125d652baa9387a349eca7dd85c
SHA512 04a3523b150ef369682c5acf0d592d1cfb2a0262f4eeec128ea11bf25e8dfec36fe248e29ba7fa5d4f14e8c6374905799e0b593ad17c0d7c8a7a22ad0f0a8d7e
SSDEEP 3:LstlNllklkXl4C:LsX3lP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\GPUCache\index
Size 256KB
SHA256 7633a4202cecb752400c0abccf86236de694ba4f6fe03e13fc062b8f201955b7
MD5 eb77ebad2ec5763c0da39b3f593343ed
SHA1 cdd03fcac8664bc7929abcf4e390aa2f469dd549
SHA512 16e18fa6a2850e87f5a8b6899f141dd958f74fe69af4580c45dcfe6ced27934ed20d5043583305913fe17c22f19187c406e88a5508df13483ed7a994922e1242
SSDEEP 3:LstlNllklkXlJG:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 104e90e97bbdeded22cc85382f7024dc6f01c79ba3dda60100b874e2bb3518b2
MD5 d94495fefd7e549785dbbc4cf3fb8d3a
SHA1 5cf02af4984313da7116d59d65c15ef3239eb80d
SHA512 e271478e2a782f20ab88f8d66a78f3cec0348c9ef5d25e654c9d2320055aa2e9d3d3d49434a9b1326eacff3365b0bac2edeb3b93ebb6a6f763b5dcd11903fac9
TLSH
T18FD0CD50898BC569050840AB95397308C770340D9F492FA98D90D808B4958098A91797
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Preferences
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 784076a79c0dd15587408381473b27ba94671f87b23473938c067d3570acef19
MD5 be34ed9e8c6d0dbf561259d9914be5ca
SHA1 c241ff3a59c7fcbab208c847b73460587028cbaa
SHA512 b5d84afa07937b4fb8406e8bfe31da2d0ae856f2a0e1cc767390b5f0747fda5f36c31c39cb888768991c528d8e38a4917cb4fd3ebd11897b31571b4e84ccd026
TLSH
T167A002625240C150D12102B1280183981340B9758210421B7FD553579C640A44D195C5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Session Storage\LOG
Size 267B
SHA256 70f5db9f87dcc1b972fc29db52d8231ad4ad4bcd984bc8c2bb13762df69b462b
MD5 15815775a6d3564e6af83ff20ad1773d
SHA1 dff66e5b3a27fed7e16d2925f10c5169b4cd46ff
SHA512 22d984dce7361eac2702b9d2098674b11a5baf7f628aeafdaf1d3fb4c82ae7a6c02d32dd134caa141303cc0a2500cbdd38bf1ce4a8b4296adaabb7a43653b84e
TLSH
T19FD02B504D8BCAB9024488B7593B230CC7E0BC0EFF4C2FBC5E61C80C714690E9782792
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 67f5dd665487adb07f69455c9e65b3f5d900665f9060b969cca6c8e63eb777e9
MD5 c6e9d06c603cd2b9973711a2d6b03ad3
SHA1 a74dd59c653558406bd2546c0cf9aeb990acc9a8
SHA512 d8b430c09b0d8889fc3fa134460d6a88f3ecbdcff1fd8f9d09f49cc94012398dcaa9b19fdd724c6e89896cc500ab92b471eacb59df6420f3c18248973104b78b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xnlgyyfa.hjx\GraphiteDawnCache\index
Size 256KB
SHA256 989d15eea418d4deb6e937a538154c4d8454ef3828865bbb34c813f7850df164
MD5 bab0ff135299cbcc37f108fdaeaeefc2
SHA1 51915acf74f6a7f6a1123ef573ca1ecc5c663aa7
SHA512 9636382cd2786e64807fbfd23ef0b1d0103e1047e28d38eb5931138942b146d1c2c9559f1b5e534b62cebee3015e001f75a587e3caea75b0bc7555c7c2743324
SSDEEP 3:LstlNllklkXl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

velogs.exe

Path C:\Users\Admin\AppData\Roaming\velogs.exe
Size 733KB
SHA256 c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31
MD5 c67f0473eae2e790676584b108e7ed73
SHA1 b14b5b72fb8314c14c5fa5e9046802b4202f3175
SHA512 bbed3f0f360ac56863d1429f11a4b4c2e9c98afa4cb971d9f7d1a561cf79c97fdf7ddd5d7831a77e769e029aa0e78a07e96202e4258e289450df9f7624406fdf
SSDEEP 12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn
TLSH
T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-205-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/300-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-7-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-4-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-10-0x0000012BF45B0000-0x0000012BF4662000-memory.dmp

Download

memory/936-14-0x0000012BF4720000-0x0000012BF4796000-memory.dmp

Download

memory/936-15-0x0000012BF4660000-0x0000012BF46B0000-memory.dmp

Download

memory/936-16-0x0000012BF4FF0000-0x0000012BF5518000-memory.dmp

Download

memory/936-17-0x0000012BDB9D0000-0x0000012BDB9EE000-memory.dmp

Download

memory/936-1-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download

memory/936-13-0x0000012BF48F0000-0x0000012BF4AB2000-memory.dmp

Download

memory/936-194-0x0000012BF46B0000-0x0000012BF46D2000-memory.dmp

Download

memory/936-6-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-5-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-8-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-3-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-2-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-0-0x0000012BD9C20000-0x0000012BD9CDE000-memory.dmp

Download

memory/936-197-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-198-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-199-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-200-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-201-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-202-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/936-203-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/5384-136-0x000001C125D30000-0x000001C125DEE000-memory.dmp

Download