2f171f88eebb4ba1bc61565d9f7350ab6a95940dd15c71d82987fd55544bf545

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MALVO Chat.exe
Size 238.2MB
Sample261102-mpk2jsvt8n
SHA256 2f171f88eebb4ba1bc61565d9f7350ab6a95940dd15c71d82987fd55544bf545
MD5 4a9144eedee69c872a0ca705b890a8f5
SHA1 b3fd3ddfa939b483b281dd1fa6ab29e6b214f772
SHA512 d4e1b937789a06bdb5d5fc979b5f21d9be779127b63caf4353d29ff430822408546651752288270c52d37a0501b8cd3b13f6ba41e4a415b0fcda7586698118e0
SSDEEP 1572864:ny4L6/7gC8FmKiW4MHq2xBi+PufAIarXSxR9K27nlnURui+9DaA3yQ2LIV67+kwv:yZJ8NVaE6xPRCc8
TLSH
T1FCC88C03E29641D9C05DD1B95B5A9633FEB1B8094B24A7DF2B5407522FA6FF82B3C720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	MALVO Chat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	MALVO Chat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	MALVO Chat.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3300	MALVO Chat.exe

Discovers running processes 1 TTPs 10 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1144	tasklist.exe
3376	tasklist.exe
3276	tasklist.exe
2392	tasklist.exe
728	tasklist.exe
4420	tasklist.exe
468	tasklist.exe
412	tasklist.exe
1520	tasklist.exe
2836	tasklist.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\scoped_dir5108_1254836145\image.ico	MALVO Chat.exe
File created	C:\Program Files\scoped_dir5108_813509715\image.ico	MALVO Chat.exe
File created	C:\Program Files\scoped_dir5108_1390611778\image.ico	MALVO Chat.exe
File created	C:\Program Files\scoped_dir5108_1279071963\image.ico	MALVO Chat.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MALVO Chat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MALVO Chat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MALVO Chat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MALVO Chat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MALVO Chat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MALVO Chat.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\shell	MALVO Chat.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\shell\open	MALVO Chat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MALVO Chat.exe\" \"%1\""	MALVO Chat.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo	MALVO Chat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\URL Protocol	MALVO Chat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\ = "URL:malvo"	MALVO Chat.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\malvo\shell\open\command	MALVO Chat.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
728	tasklist.exe
728	tasklist.exe
4420	tasklist.exe
4420	tasklist.exe
468	tasklist.exe
468	tasklist.exe
412	tasklist.exe
412	tasklist.exe
1144	tasklist.exe
1144	tasklist.exe
1520	tasklist.exe
1520	tasklist.exe
3376	tasklist.exe
3376	tasklist.exe
3276	tasklist.exe
3276	tasklist.exe
3300	MALVO Chat.exe
3300	MALVO Chat.exe
2836	tasklist.exe
2836	tasklist.exe
2392	tasklist.exe
2392	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeDebugPrivilege	728	tasklist.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe
Token: SeShutdownPrivilege	5108	MALVO Chat.exe
Token: SeCreatePagefilePrivilege	5108	MALVO Chat.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe
5108	MALVO Chat.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2508	5108	MALVO Chat.exe	87
PID 5108 wrote to memory of 4992	5108	MALVO Chat.exe	88
PID 5108 wrote to memory of 4808	5108	MALVO Chat.exe	89
PID 5108 wrote to memory of 3592	5108	MALVO Chat.exe	90
PID 5108 wrote to memory of 728	5108	MALVO Chat.exe	92
PID 5108 wrote to memory of 4420	5108	MALVO Chat.exe	96
PID 5108 wrote to memory of 468	5108	MALVO Chat.exe	100
PID 5108 wrote to memory of 412	5108	MALVO Chat.exe	102
PID 5108 wrote to memory of 1144	5108	MALVO Chat.exe	104
PID 5108 wrote to memory of 1520	5108	MALVO Chat.exe	106
PID 5108 wrote to memory of 3376	5108	MALVO Chat.exe	108
PID 5108 wrote to memory of 3276	5108	MALVO Chat.exe	110
PID 5108 wrote to memory of 3300	5108	MALVO Chat.exe	112
PID 5108 wrote to memory of 2836	5108	MALVO Chat.exe	113
PID 5108 wrote to memory of 2392	5108	MALVO Chat.exe	115

C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
"C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
  "C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe" --type=gpu-process --gpu-recent-crash-count=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\MALVO Chat" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1884,i,6511096903966975342,8669520102564690245,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10056187586230194819,10211924784115650300,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:2508
- C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
  "C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\MALVO Chat" --field-trial-handle=1884,i,6511096903966975342,8669520102564690245,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10056187586230194819,10211924784115650300,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2044 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4992
- C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
  "C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MALVO Chat" --app-user-model-id=eu.malvo.chat --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --allow-file-access-from-files --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1884,i,6511096903966975342,8669520102564690245,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10056187586230194819,10211924784115650300,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2560 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
  "C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\MALVO Chat" --app-user-model-id=eu.malvo.chat --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --allow-file-access-from-files --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1884,i,6511096903966975342,8669520102564690245,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10056187586230194819,10211924784115650300,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3592
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe
  "C:\Users\Admin\AppData\Local\Temp\MALVO Chat.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\MALVO Chat" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1884,i,6511096903966975342,8669520102564690245,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1888,i,10056187586230194819,10211924784115650300,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:2836
- C:\Windows\system32\tasklist.exe
  tasklist /v /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

image.ico

Path C:\Program Files\scoped_dir5108_1254836145\image.ico
Size 55KB
SHA256 5139a7a81b941d4cf86eaa548ade842388d88bce850f39e5f952c9e0289ec088
MD5 440f847d4bdcc964054f17509428cacf
SHA1 cd0e99b3b33b3ef9c5fc6d4259e0434a5af6c300
SHA512 09ba55b49eb2adb5946684a09b7d9b8bfb742271b6d44d994413154ceb15de5fe93ff9ae73b599adbc4374a103b85305e271cd2204ded66f6db753312c2caac0
SSDEEP 1536:P2XJypXd62kvDrfCwxPDx6i6ZKa5R3e2PrlkXL:PFbaN9DxyZDHe2PrlkXL
TLSH
T1F54302BDE29CD7BB59224DC056089E4B2371413754E81796E71D2368DF96BD03883FCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 9d000669b2ea21fb0653b7ba05c7b815086c62c09c100c9e63551eef7c77c516
MD5 f20fd8b574037e8776aedb877c8c2724
SHA1 c85b276f6999a04b86997a318f051bb54b5c93ed
SHA512 ad911d828c731e35f6ec625b20ed36b2aafb9a5049dfb589110786f16db03fe1e02689d71608f99e3e2732064e9208bfaa7b0a131527609b1cd85b19a49c9067
TLSH
T1A0B0015069294402CB4BA2BA2AD284AA35788A530E0B4E85A1D05574D862BE16501971
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 85364a8268109ed3fd611da13e65d63b825faad09ec140998f5bd315aa3ce4a3
MD5 ee69ffd22cb8e6f57405eb85a7beda81
SHA1 fc3b56c622e56c06016055467a2d2922e791f35a
SHA512 0bab2d4c80d8509857a4829b9cc5cdb7be1e70434470cc05e17c6904483fc27c5d8e13f75ed099f655b40b3b283ca5579956586568a3f1e31d1b1b338f11c466
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State2c98d185-aa47-443b-bdc5-c91b8c7f99c2.tmp

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Network\Network Persistent State2c98d185-aa47-443b-bdc5-c91b8c7f99c2.tmp
Size 180B
SHA256 3c595f12b53940453b6de0616761fb3dca804f4d44631cfe897048f64952964b
MD5 5b81edca54e83b3df55f66831cc31618
SHA1 1c063e4bd155a557d932688eafcc441904b3bb00
SHA512 dd2dd157c26d479026b19f5cadf8a9909f202eb35aae7081ee2977ab21fae8c3db5ed64318b9ba654356cb2338bdad192d46b6bdbf3b33b823e06643cca514f0
TLSH
T16DC0C0EA82306CFF034183F00E14B813C2FF0402232C5D56C6247F2C437207D4400847
MD5 SHA1 SHA512 TLSH

Submit Download

Preferencese0ea4b46-fe8e-454f-8b12-4c8928ca3238.tmp

Path C:\Users\Admin\AppData\Roaming\MALVO Chat\Preferencese0ea4b46-fe8e-454f-8b12-4c8928ca3238.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3300-208-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-199-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-198-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-197-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-209-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-207-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-206-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-205-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-204-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/3300-203-0x000001C539CD0000-0x000001C539CD1000-memory.dmp

Download

memory/4808-21-0x00007FF896350000-0x00007FF896351000-memory.dmp

Download

memory/4808-20-0x00007FF897CD0000-0x00007FF897CD1000-memory.dmp

Download