phantom_stealer | 3feb5b6941b766f05d36adc9e2de9a3f631e9722d4bf083c2de4c0d5ff5208e2

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 733KB
Sample260916-26cttstyft
SHA256 3feb5b6941b766f05d36adc9e2de9a3f631e9722d4bf083c2de4c0d5ff5208e2
MD5 4e2b713333af326c9a2bf8a35921b67b
SHA1 2e2e91c941f136eecb4ebfcd3e279aabca6a095b
SHA512 9aa2ac80ac2527f312e287d3f84d6d337b16952da23f0ab8b37028cd43d464317c4013ea33a770248928a5d7bb93d82abb890affdb9f262725081a079f82e88c
SSDEEP 12288:T9WXbMskTPr6NcUkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab+3NUW6:T9WXMr6NcUkqjVnlqud+/2P+ATAS/JY
TLSH
T144F4DF58B3F85A00F1FF5BB194B59D51AB35B513A962D71E11C080D80EB2B918F8AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection costura discovery phantom_stealer packer spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
fse-za.net
Port
587
Username
[email protected]
Password
123Abc1!@#
Email to
[email protected]

Mutex

Q48K5S2K6OEJTRJEK22R

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/4548-0-0x00000299D9A40000-0x00000299D9AFE000-memory.dmp	family_phantomstealer
behavioral1/memory/3320-12-0x00000202D1070000-0x00000202D112E000-memory.dmp	family_phantomstealer

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	icanhazip.com

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/3320-12-0x00000202D1070000-0x00000202D112E000-memory.dmp	costura

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4548	file.exe
4548	file.exe
4752	chrome.exe
4752	chrome.exe
4548	file.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	file.exe
Token: SeShutdownPrivilege	4752	chrome.exe
Token: SeCreatePagefilePrivilege	4752	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4752	chrome.exe
4752	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4548	file.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4752	4548	file.exe	85
PID 4752 wrote to memory of 3320	4752	chrome.exe	86
PID 4548 wrote to memory of 3320	4548	file.exe	86
PID 4548 wrote to memory of 3320	4548	file.exe	86
PID 4752 wrote to memory of 1356	4752	chrome.exe	87
PID 4752 wrote to memory of 4340	4752	chrome.exe	88
PID 4752 wrote to memory of 3016	4752	chrome.exe	89
PID 4752 wrote to memory of 1872	4752	chrome.exe	90
PID 4752 wrote to memory of 3296	4752	chrome.exe	91
PID 4752 wrote to memory of 4796	4752	chrome.exe	92
PID 4752 wrote to memory of 3340	4752	chrome.exe	93
PID 4752 wrote to memory of 1424	4752	chrome.exe	95
PID 4752 wrote to memory of 4248	4752	chrome.exe	96

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd29d2c728,0x7ffd29d2c734,0x7ffd29d2c740
    3⤵
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1696,i,11479714761332811692,3224180888430899940,262144 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,12969699350462363715,16991108412841556889,524288 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,10034687794875485734,5881744925151357710,524288 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
    3⤵
    PID:3016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,15208827661487985545,5105905030265516940,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,4304601639596699038,4246864555921485077,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3128,i,17293352150460877782,17803224021726636628,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3140,i,17069379032689704510,1313954018167808618,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:2
    3⤵
    PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3748,i,12609773842808810673,18158649733016521182,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4116,i,17327355177504943456,11272655951796245527,2097152 --field-trial-handle=1944,i,6458264619763362036,7777795528341981818,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:2
    3⤵
    PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Crashpad\settings.dat
Size 40B
SHA256 3835b73c7cfd1549f81ebf8823f022dcf8288c47482da7dbeb986b05bc0dfab0
MD5 023c7c6dd4a3dba8c327eb0a27e7cda6
SHA1 56b155e910d784d81827967c5b1aa76ed2be7b38
SHA512 9a34a3e0dc5c99a9dfab121b7f123bb5308bb331855700c83b7baee7a5ed1ec799fed1013900320f9ef3a5a0dd881781924bb3a47b9cb769b66739fb58ad1670
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Cache\Cache_Data\index
Size 256KB
SHA256 11edfa3a3c16d530991a5a3caf7ffd8a0cfeda44ea00710dbdd8b963c7f446e4
MD5 f05208bb1095a645e0292e6b9a59c7e3
SHA1 e2db0fbc0404e66ad842dd2346982933effd895c
SHA512 e1abb377500ccfc8236c0ffe9ed0c08407ef5ba93b471d1a7245517606881ac43526543b9a94aead914da32cb0d56c887f9f9828f26dba64990bdb6a4f0d7c12
SSDEEP 3:LstlllXjoll:LsX/zo/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 8744c746057357460ff7d45a86c2d5d5b75904390f6b704f5c0ff665c9ec4db6
MD5 e838af69ea62219ccffd75722fba8786
SHA1 9f27cfa3b699e4bab335a7179bbd8e2b87d13497
SHA512 256dfe176b1000593a6f1c6021d0abc245b0af6638d2fe8add1ce38000448fb3264927427cbc9e5036c54242043330af4a82b8989bd4ae7cb365696731d86036
TLSH
T112E02B85824C0F0DD32DA6F7CDE603048A0E53C429BE7603A880C6C273125381248223
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6aa80c42cdc0fb981da6635a590d512a304191153f9a1847e85785f486a5a81f
MD5 58ea35599c27519e9650dd80efee882b
SHA1 72d52b8aee3abe156f90df5d8f2f1bcf33305508
SHA512 6102ba4fb4e58d3801501998ade40aeccb0752a193eb20ff24d147a0bdee21a9aab858bca02a53fd905690e9f1a4a9ae8515b1af7b05f7e5ec811a8256e01ea7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 c1120022471d8b44dbdcc2357bcbd4a715b505cfc2770d5ea3962a3c460b56e4
MD5 9d000aa9bf0ea89a0df0b397ff30543f
SHA1 35f84e110c36a4eab487d9568c509586b33e80f6
SHA512 a2cd1e27e29697f6e4d66d5f8716256364454b56c9a657353c7b03d5821026972e8c6fbe8216197ac14410bc6bc05d8e321a5b66765e8c24fc5bb7126f134167
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\DawnGraphiteCache\index
Size 256KB
SHA256 33794ca94727c6e5f99258bffe2ddcb3d2089259510dfef9838d7fb456538969
MD5 5b31ed5e91c43ada59eb8af26354edce
SHA1 59f7ced814e6baec6778192efebbf3b0c19d48db
SHA512 32255f85f2d728188847acefa4f13cb7a20ee8b4f4ea687c1eb692e7b2dc526db6e460649558f1257d131e844c081f7c9085317bae4bd58167ac312c765d608b
SSDEEP 3:LstlNllklkXlUm4t:LsX3lPUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\DawnWebGPUCache\index
Size 256KB
SHA256 003a4e31aa5c75abf88320fbc278befed006f9990e502166371479e51edf05e5
MD5 2ea96f66aa13a625936943815ac94be3
SHA1 b82ab23a321eacad138ad36f914db40da39dcaec
SHA512 822888f055d4ad9fea898a484af0d06a5dce32f48bca6e6c34a4b9dc8397fe068fe6ef3d5e1c62c06a5e5d96efbd14abdd4170d7f9856c48c6947012bc294839
SSDEEP 3:LstlNllklkXlD:LsX3lPD
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\GPUCache\index
Size 256KB
SHA256 899926ae367209051e3262e437c97961588f2843c2640810073d8edfd77d5c24
MD5 76865355e25310342b7789c4c816fd1d
SHA1 9f3af653b02cb8b2efc4671c9f3bbf60bd415a08
SHA512 7e63adc244c669236cbefc2dc89d6a54adcc27dac6089aa0a8bc8307857fedc7241832627309674f807f6661df6a7584041eb3858960b064401f4aa5acc011c3
SSDEEP 3:LstlNllklkXlcrdi:LsX3lPcs
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 c45f819baada4bf8448d68d403e3070398df88eda8a736f37a47ff7cea60341b
MD5 9e31e1411e808a2d60529390e0fb952f
SHA1 6ecb538c4abdf494a118fcee11b0720182766da6
SHA512 e877285ebb56a246be1b5026ae990f4f070d066c599844ec0a6fd2158695ff6c025428fde5616ca91114b9c30feff32ab7f209845298f65bcb8ad1be398dec5e
TLSH
T139D0CD504057C5DD0348516B47656F0CDF30354CD7AD3B244EEDDC4DB04500CDB81782
MD5 SHA1 SHA512 TLSH

Submit Download

Cookies-journal

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Network\Cookies-journal
Size 512B
SHA256 4d6e81a0ff8f200bf9fce156ec9af5b69e3222a5547588c10a33fa64c1ce3b83
MD5 9820238649735cfe714251cd93cea223
SHA1 237a183fef2b9b6b444ef229dbea8f7508da0a8c
SHA512 c280cfb1633015071095a3eff0e0ee48b58bb2aca99268a27bc4ba46a29460a0a5cfa5362addd9db0dfc11a8b2b51bf28d39a317b1ffa4908481f7ae9d51ff1d
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Network\Reporting and NEL
Size 12KB
SHA256 44ff665cfd6ae79e54fd82f1da037adb5f4c3cf790138faf98d46a756d9b3c9a
MD5 98a6cd781c6b1dd60b5fec3ff9d54131
SHA1 792404f18fdfe348a8d1e2e6ccdc2cf3df2c3824
SHA512 f5ac2f8ce83f11e91306f3d65c78d7c47b96abee703eeb9917b30b993b20daf272a795cdd6d31479539e569d1e234de1485be053fa6b9eca5bc0fff2d872c8a4
SSDEEP 6:l9bNFlEuWks/l5qKZwkvAngLusiOImWtz0vlWmW8QeZa5qguxtqlyup6YZ75fOV:TLiuWk4l0KONFxOUwa5qguWfpbZ75fOV
TLSH
T10D4220471F582832E8695F3D51C746D40F76E52C8740ED03816888612E908C455DE457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL-journal

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Network\Reporting and NEL-journal
Size 512B
SHA256 b861f81001db38661be3cd5f03c0c8cb2041c46663cec97fd0542eda01da74a6
MD5 7081e0e7851a459e09482e0125e05419
SHA1 12b63b67bdae3dd92f39f63fec02f98da0cb5418
SHA512 bdfeb9448aa5a42bea1039ebc0139fcd04f917c0ecc1ad71310362860020343e3ce6a46b2620392537d49af4feb930d6eb2e8a695ae7c96ab44e35aaf426bd46
MD5 SHA1 SHA512

Submit Download

Trust Tokens-journal

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Network\Trust Tokens-journal
Size 512B
SHA256 e4e402133c9788ef09169c5b6738089faeeb90d374a08c9aef53a957e5e0cb16
MD5 80e14a0923992fb63d3e65f4f24ffef0
SHA1 0a459be1278eb9fbc884b505fce8bb53da591efd
SHA512 19fa1ebe9ded563e0fe55eb93d0cf9b3757d4fe53f23e4c9e49321871c18ad50e68644b326772b432866b707e5a89c28d4ebc76ca61a84f20934f653463f0ee7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Preferences
Size 3KB
SHA256 4299ac0bc559ba816b1328dbcff31339a94443f53f3933dd9a79445e568d28e1
MD5 06d15c8e41c15b3bc58172385aed670f
SHA1 70972ed53c856f2e658cdefa65dabe12c6853a32
SHA512 01e70c01281b8e1742dcc68b68aee9c864561f54728557ba525bf2253e7750b8c8cb19ab5ecad7d6af939d2da67a7fe87ee89f45c9b1f06c7eca8d91defb6ef1
TLSH
T1AF618599C5644CAB9DF2B675B9390785FA22936B014018033D7E068D4FB7A2B80C0FBD
MD5 SHA1 SHA512 TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Session Storage\LOG
Size 267B
SHA256 55bf254b3b36e7b2d38a71042531fc5e0282e6d149814cc321de5ffa7db646b1
MD5 9421e621a998608e0aafda81aa2b7aab
SHA1 61f0305894f684da800b10c91fe7dc0c5ca8d8e8
SHA512 51f3770031256f750f67e9022fa52797135561b7ca1e8f9adeff5818609e53d5ce3ced2d444a89ee2e41f83bdf2324f1c2a4420f8b0da31e605b148532631181
TLSH
T1ACD012504497C5ED4694947B0A619F0DDAA07588F77C2B344ABBD84D714640AEB82646
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 748af45b1bb4a25f027b1a165d1c407aa4de8ffb42bf4663974ae7d3f0ede5e8
MD5 df194eb977573ccfa583396e82096704
SHA1 413f7a1c06f49ffea61179f81d5d86e8362dab4e
SHA512 375c8794a28c2fa013c2f2842d1d917affc51fcdb8c45d7bd16709695138975dbddbcb7493725710918aa556ebcc66cb4b9866f73ce495bee4abb82319a37c24
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xg1slvwk.hsx\GraphiteDawnCache\index
Size 256KB
SHA256 8645750e21df2b7743929a4d98bb61ba780b8edbc85730bf9863662470af8296
MD5 a537279bbf25419772912840179f66ef
SHA1 7a5cd1a15a12116109245df85a9064e5af45f172
SHA512 d0b87da169518d9786145881cf852ced1dca033a921801fc9b7e6a8d01e000a8430b9133bb9348813949050f31ae15621c53c7a341218af7eae3db0e6cdcb639
SSDEEP 3:LstlNllklkXlutf+ll:LsX3lPutG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3320-12-0x00000202D1070000-0x00000202D112E000-memory.dmp

Download

memory/4548-174-0x00000299F4AA0000-0x00000299F4AC2000-memory.dmp

Download

memory/4548-0-0x00000299D9A40000-0x00000299D9AFE000-memory.dmp

Download

memory/4548-7-0x00000299F3F90000-0x00000299F3FAE000-memory.dmp

Download

memory/4548-6-0x00000299F5320000-0x00000299F5848000-memory.dmp

Download

memory/4548-5-0x00000299F4A50000-0x00000299F4AA0000-memory.dmp

Download

memory/4548-4-0x00000299F4AD0000-0x00000299F4B46000-memory.dmp

Download

memory/4548-3-0x00000299F4C20000-0x00000299F4DE2000-memory.dmp

Download

memory/4548-2-0x00000299F49A0000-0x00000299F4A52000-memory.dmp

Download

memory/4548-1-0x00000299F3FE0000-0x00000299F3FF0000-memory.dmp

Download

memory/4548-178-0x00000299F3FE0000-0x00000299F3FF0000-memory.dmp

Download