xbinder | 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 12.1MB
Sample260503-tskzaagw6n
SHA256 1857ca432a680b69e247e61cb4c95b8b7827ea3d32cbe716251ab9f2b6b6d766
MD5 43949f2de3c160b7135a11d4d292b8b3
SHA1 d1346c0bca958e3c225a7653f09cee36d840285a
SHA512 9c7e7c594f8936935de152a7c334b9f19a4fae0d521a23d2e523171bc5b9522c30897109c4e1dd8dfb61cb722031ed0ce60da7a1c088d6e5856b06fee8ce43bc
SSDEEP 196608:GW4NDHH+SJcOpbN5oKesKFewST06Ov5qMoHp9ZHBgdMMwHdzS5sUUTLxD:nsDnFpbHieTo5tolhgdMMwHM5srR
TLSH
T137D633F46AC93974F2EB4B3D73624FE9C9A62725342E02B8E0E4435D8BD7A8D45DC850
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xbinder xworm loader persistence rat trojan

Malware Config

Extracted

Family

xbinder

Mutex

oBySjGJkKWMXO6yKN

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
velocityy.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
Velocity.exe

Extracted

Family

xworm

Version

aferistin-41691.portmap.host:41691

Attributes

Install_directory
%AppData%
install_file
USB.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x002200000002b1aa-6.dat	family_xworm
behavioral2/memory/2356-13-0x00000000009D0000-0x00000000009E4000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
3188	powershell.exe
1596	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\velocityy.lnk	velocityy.exe

Executes dropped EXE 58 IoCs

pid	Process
2356	velocityy.exe
3684	velocityy.exe
880	velocityy.exe
3376	velocityy.exe
4892	velocityy.exe
1920	velocityy.exe
2996	velocityy.exe
2820	velocityy.exe
2024	velocityy.exe
4444	velocityy.exe
5016	velocityy.exe
3172	velocityy.exe
4304	velocityy.exe
2700	velocityy.exe
4048	velocityy.exe
1716	velocityy.exe
4420	velocityy.exe
3928	velocityy.exe
1820	velocityy.exe
460	velocityy.exe
4036	velocityy.exe
1080	velocityy.exe
2840	velocityy.exe
1284	velocityy.exe
5028	velocityy.exe
1788	velocityy.exe
484	velocityy.exe
3396	velocityy.exe
3808	velocityy.exe
2528	velocityy.exe
2616	velocityy.exe
4532	velocityy.exe
1120	velocityy.exe
5060	velocityy.exe
4416	velocityy.exe
2788	velocityy.exe
2232	velocityy.exe
4908	velocityy.exe
3688	velocityy.exe
3564	velocityy.exe
1216	velocityy.exe
1824	velocityy.exe
4936	velocityy.exe
4720	velocityy.exe
4364	velocityy.exe
1468	velocityy.exe
908	velocityy.exe
1248	velocityy.exe
4960	velocityy.exe
1920	velocityy.exe
4072	velocityy.exe
2548	velocityy.exe
5004	velocityy.exe
4480	velocityy.exe
5048	velocityy.exe
4688	velocityy.exe
4648	velocityy.exe
2080	velocityy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\velocityy = "C:\\Users\\Admin\\AppData\\Roaming\\velocityy.exe"	velocityy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2912	powershell.exe
2912	powershell.exe
3188	powershell.exe
3188	powershell.exe
1596	powershell.exe
1596	powershell.exe
2356	velocityy.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	velocityy.exe
Token: SeDebugPrivilege	3684	velocityy.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	880	velocityy.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	3376	velocityy.exe
Token: SeDebugPrivilege	2356	velocityy.exe
Token: SeDebugPrivilege	4892	velocityy.exe
Token: SeDebugPrivilege	1920	velocityy.exe
Token: SeDebugPrivilege	2996	velocityy.exe
Token: SeDebugPrivilege	2820	velocityy.exe
Token: SeDebugPrivilege	2024	velocityy.exe
Token: SeDebugPrivilege	4444	velocityy.exe
Token: SeDebugPrivilege	5016	velocityy.exe
Token: SeDebugPrivilege	3172	velocityy.exe
Token: SeDebugPrivilege	4304	velocityy.exe
Token: SeDebugPrivilege	2700	velocityy.exe
Token: SeDebugPrivilege	4048	velocityy.exe
Token: SeDebugPrivilege	1716	velocityy.exe
Token: SeDebugPrivilege	4420	velocityy.exe
Token: SeDebugPrivilege	3928	velocityy.exe
Token: SeDebugPrivilege	1820	velocityy.exe
Token: SeDebugPrivilege	460	velocityy.exe
Token: SeDebugPrivilege	4036	velocityy.exe
Token: SeDebugPrivilege	1080	velocityy.exe
Token: SeDebugPrivilege	2840	velocityy.exe
Token: SeDebugPrivilege	1284	velocityy.exe
Token: SeDebugPrivilege	5028	velocityy.exe
Token: SeDebugPrivilege	1788	velocityy.exe
Token: SeDebugPrivilege	484	velocityy.exe
Token: SeDebugPrivilege	3396	velocityy.exe
Token: SeDebugPrivilege	3808	velocityy.exe
Token: SeDebugPrivilege	2528	velocityy.exe
Token: SeDebugPrivilege	2616	velocityy.exe
Token: SeDebugPrivilege	4532	velocityy.exe
Token: SeDebugPrivilege	1120	velocityy.exe
Token: SeDebugPrivilege	5060	velocityy.exe
Token: SeDebugPrivilege	4416	velocityy.exe
Token: SeDebugPrivilege	2788	velocityy.exe
Token: SeDebugPrivilege	2232	velocityy.exe
Token: SeDebugPrivilege	4908	velocityy.exe
Token: SeDebugPrivilege	3688	velocityy.exe
Token: SeDebugPrivilege	3564	velocityy.exe
Token: SeDebugPrivilege	1216	velocityy.exe
Token: SeDebugPrivilege	1824	velocityy.exe
Token: SeDebugPrivilege	4936	velocityy.exe
Token: SeDebugPrivilege	4720	velocityy.exe
Token: SeDebugPrivilege	4364	velocityy.exe
Token: SeDebugPrivilege	1468	velocityy.exe
Token: SeDebugPrivilege	908	velocityy.exe
Token: SeDebugPrivilege	1248	velocityy.exe
Token: SeDebugPrivilege	4960	velocityy.exe
Token: SeDebugPrivilege	1920	velocityy.exe
Token: SeDebugPrivilege	4072	velocityy.exe
Token: SeDebugPrivilege	2548	velocityy.exe
Token: SeDebugPrivilege	5004	velocityy.exe
Token: SeDebugPrivilege	4480	velocityy.exe
Token: SeDebugPrivilege	5048	velocityy.exe
Token: SeDebugPrivilege	4688	velocityy.exe
Token: SeDebugPrivilege	4648	velocityy.exe
Token: SeDebugPrivilege	2080	velocityy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2356	velocityy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2356	768	Velocity.exe	79
PID 768 wrote to memory of 4352	768	Velocity.exe	80
PID 4352 wrote to memory of 3684	4352	Velocity.exe	81
PID 4352 wrote to memory of 1692	4352	Velocity.exe	82
PID 2356 wrote to memory of 2912	2356	velocityy.exe	83
PID 2356 wrote to memory of 3188	2356	velocityy.exe	85
PID 1692 wrote to memory of 880	1692	Velocity.exe	87
PID 1692 wrote to memory of 2676	1692	Velocity.exe	88
PID 2356 wrote to memory of 1596	2356	velocityy.exe	89
PID 2676 wrote to memory of 3376	2676	Velocity.exe	92
PID 2676 wrote to memory of 4388	2676	Velocity.exe	93
PID 4388 wrote to memory of 4892	4388	Velocity.exe	94
PID 4388 wrote to memory of 1440	4388	Velocity.exe	95
PID 1440 wrote to memory of 1920	1440	Velocity.exe	96
PID 1440 wrote to memory of 1128	1440	Velocity.exe	97
PID 1128 wrote to memory of 2996	1128	Velocity.exe	98
PID 1128 wrote to memory of 3704	1128	Velocity.exe	99
PID 3704 wrote to memory of 2820	3704	Velocity.exe	100
PID 3704 wrote to memory of 2348	3704	Velocity.exe	101
PID 2348 wrote to memory of 2024	2348	Velocity.exe	102
PID 2348 wrote to memory of 3176	2348	Velocity.exe	103
PID 3176 wrote to memory of 4444	3176	Velocity.exe	104
PID 3176 wrote to memory of 652	3176	Velocity.exe	105
PID 652 wrote to memory of 5016	652	Velocity.exe	106
PID 652 wrote to memory of 2608	652	Velocity.exe	107
PID 2608 wrote to memory of 3172	2608	Velocity.exe	108
PID 2608 wrote to memory of 3192	2608	Velocity.exe	109
PID 3192 wrote to memory of 4304	3192	Velocity.exe	110
PID 3192 wrote to memory of 1200	3192	Velocity.exe	111
PID 1200 wrote to memory of 2700	1200	Velocity.exe	112
PID 1200 wrote to memory of 3308	1200	Velocity.exe	113
PID 3308 wrote to memory of 4048	3308	Velocity.exe	114
PID 3308 wrote to memory of 1460	3308	Velocity.exe	115
PID 1460 wrote to memory of 1716	1460	Velocity.exe	116
PID 1460 wrote to memory of 4584	1460	Velocity.exe	117
PID 4584 wrote to memory of 4420	4584	Velocity.exe	118
PID 4584 wrote to memory of 2424	4584	Velocity.exe	119
PID 2424 wrote to memory of 3928	2424	Velocity.exe	120
PID 2424 wrote to memory of 232	2424	Velocity.exe	121
PID 232 wrote to memory of 1820	232	Velocity.exe	122
PID 232 wrote to memory of 436	232	Velocity.exe	123
PID 436 wrote to memory of 460	436	Velocity.exe	124
PID 436 wrote to memory of 4724	436	Velocity.exe	125
PID 4724 wrote to memory of 4036	4724	Velocity.exe	126
PID 4724 wrote to memory of 4356	4724	Velocity.exe	127
PID 4356 wrote to memory of 1080	4356	Velocity.exe	128
PID 4356 wrote to memory of 4752	4356	Velocity.exe	129
PID 4752 wrote to memory of 2840	4752	Velocity.exe	130
PID 4752 wrote to memory of 3968	4752	Velocity.exe	131
PID 3968 wrote to memory of 1284	3968	Velocity.exe	132
PID 3968 wrote to memory of 4240	3968	Velocity.exe	133
PID 4240 wrote to memory of 5028	4240	Velocity.exe	134
PID 4240 wrote to memory of 4600	4240	Velocity.exe	135
PID 4600 wrote to memory of 1788	4600	Velocity.exe	136
PID 4600 wrote to memory of 5024	4600	Velocity.exe	137
PID 5024 wrote to memory of 484	5024	Velocity.exe	138
PID 5024 wrote to memory of 3924	5024	Velocity.exe	139
PID 3924 wrote to memory of 3396	3924	Velocity.exe	140
PID 3924 wrote to memory of 3388	3924	Velocity.exe	141
PID 3388 wrote to memory of 3808	3388	Velocity.exe	142
PID 3388 wrote to memory of 1880	3388	Velocity.exe	143
PID 1880 wrote to memory of 2528	1880	Velocity.exe	144
PID 1880 wrote to memory of 4692	1880	Velocity.exe	145
PID 4692 wrote to memory of 2616	4692	Velocity.exe	146

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\velocityy.exe
  "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\velocityy.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\Users\Admin\AppData\Local\Temp\Velocity.exe
  "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
    "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
    "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
      "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
      "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        32⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        33⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        34⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        35⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        36⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        37⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        38⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        39⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        40⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        41⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        42⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        43⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        44⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        45⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        46⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        47⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        48⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        49⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        50⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        51⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        52⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        53⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        54⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        55⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        56⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        57⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        58⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        58⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\velocityy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\velocityy.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Velocity.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
        59⤵
        
        PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Velocity.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Velocity.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 63d687ea2b0d8794ede672e8fa1c00bbb02cf4e71f1a1a3428b1e8c1bbdd7a35
MD5 42ad49498494cb92cfeee0d43ae0f549
SHA1 6ef22ae659cae90cb8d27d62b6d6c6ad045e2377
SHA512 a6027d733b61761f731657d21b4a4c521b74823f3a8ba4c27c838ba64663de8b6ab2962d4413050026dac3c79660d9ef4b29b5a23e0da7a7d7c02a5bef8ed6da
TLSH
T1F6218933B79CC134C8D9117A108DAD01B2B5C3C7449ECECB7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i3xlk2sn.ob0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i3xlk2sn.ob0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

velocityy.exe

Path C:\Users\Admin\AppData\Local\Temp\velocityy.exe
Size 57KB
SHA256 402dfcad45c1accc395ec18cc56d4dae549f30dfe251bdfbd556d7de42ecdb40
MD5 41e0dc39cc6da98fa73b25326c3cf6a3
SHA1 81c8ca8881a4b44e57df5d39d51f5eacdbdd0769
SHA512 7983cb5a9af5686e678029418a57d6bae3675bf4d2cc5325ffb87b0b8bc4d6ff02dd13a25d306b3b56eb40e982194dc66373d4f3881239a5911b34f44f701271
SSDEEP 1536:mWOYjOFEjXQYoXegGGI20rFcbFZbfZLu6ajV8Ot+Ji:mWmFEGYGo2FZbfYj2OtQi
TLSH
T1EC437C287BE58465D1FF6BB11DE66392D735F3534A13D72F28C8028A1623E88CE417E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-137-0x0000000001B70000-0x0000000001BA1000-memory.dmp

Download

memory/652-138-0x0000000001BE0000-0x0000000001BEC000-memory.dmp

Download

memory/768-0-0x00000000009F0000-0x0000000001618000-memory.dmp

Download

memory/768-16-0x0000000001E70000-0x0000000001E7C000-memory.dmp

Download

memory/768-1-0x000000001C300000-0x000000001C310000-memory.dmp

Download

memory/768-15-0x0000000001DC0000-0x0000000001DF1000-memory.dmp

Download

memory/880-95-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Download

memory/880-94-0x0000000000AA0000-0x0000000000AD1000-memory.dmp

Download

memory/1128-115-0x00000000021C0000-0x00000000021CC000-memory.dmp

Download

memory/1128-114-0x00000000020D0000-0x0000000002101000-memory.dmp

Download

memory/1200-155-0x0000000003430000-0x000000000343C000-memory.dmp

Download

memory/1200-154-0x0000000001960000-0x0000000001991000-memory.dmp

Download

memory/1440-110-0x00000000039F0000-0x00000000039FC000-memory.dmp

Download

memory/1440-109-0x0000000002150000-0x0000000002181000-memory.dmp

Download

memory/1596-87-0x000001C7F3050000-0x000001C7F305C000-memory.dmp

Download

memory/1596-88-0x000001C7F4910000-0x000001C7F4922000-memory.dmp

Download

memory/1596-86-0x000001C7F2F50000-0x000001C7F2F81000-memory.dmp

Download

memory/1692-63-0x0000000001CD0000-0x0000000001D01000-memory.dmp

Download

memory/1692-64-0x0000000001D50000-0x0000000001D5C000-memory.dmp

Download

memory/1920-117-0x00000000024B0000-0x00000000024BC000-memory.dmp

Download

memory/1920-116-0x0000000000DA0000-0x0000000000DD1000-memory.dmp

Download

memory/2024-134-0x0000000001570000-0x00000000015A1000-memory.dmp

Download

memory/2024-135-0x0000000002B80000-0x0000000002B8C000-memory.dmp

Download

memory/2348-128-0x0000000001DE0000-0x0000000001DEC000-memory.dmp

Download

memory/2348-127-0x0000000001D60000-0x0000000001D91000-memory.dmp

Download

memory/2356-101-0x00000000011E0000-0x0000000001211000-memory.dmp

Download

memory/2356-102-0x00000000029F0000-0x00000000029FC000-memory.dmp

Download

memory/2356-100-0x000000001B810000-0x000000001B820000-memory.dmp

Download

memory/2356-123-0x000000001B810000-0x000000001B820000-memory.dmp

Download

memory/2356-13-0x00000000009D0000-0x00000000009E4000-memory.dmp

Download

memory/2608-142-0x0000000001F60000-0x0000000001F91000-memory.dmp

Download

memory/2608-143-0x0000000002000000-0x000000000200C000-memory.dmp

Download

memory/2676-92-0x0000000003130000-0x000000000313C000-memory.dmp

Download

memory/2676-91-0x00000000015E0000-0x0000000001611000-memory.dmp

Download

memory/2820-129-0x0000000001330000-0x0000000001361000-memory.dmp

Download

memory/2820-130-0x0000000002940000-0x000000000294C000-memory.dmp

Download

memory/2912-39-0x000001ADEC310000-0x000001ADEC32A000-memory.dmp

Download

memory/2912-27-0x000001ADEBB40000-0x000001ADEBB62000-memory.dmp

Download

memory/2912-34-0x000001ADEBD70000-0x000001ADEBD8C000-memory.dmp

Download

memory/2912-35-0x000001ADEBFC0000-0x000001ADEC073000-memory.dmp

Download

memory/2912-36-0x000001ADEBD90000-0x000001ADEBD9A000-memory.dmp

Download

memory/2912-37-0x000001ADEC2F0000-0x000001ADEC30C000-memory.dmp

Download

memory/2912-38-0x000001ADEBDA0000-0x000001ADEBDAA000-memory.dmp

Download

memory/2912-42-0x000001ADEC330000-0x000001ADEC33A000-memory.dmp

Download

memory/2912-40-0x000001ADEC2D0000-0x000001ADEC2D8000-memory.dmp

Download

memory/2912-41-0x000001ADEC2E0000-0x000001ADEC2E6000-memory.dmp

Download

memory/2912-45-0x000001ADD1EF0000-0x000001ADD1F21000-memory.dmp

Download

memory/2912-47-0x000001ADD3780000-0x000001ADD3792000-memory.dmp

Download

memory/2912-46-0x000001ADD3550000-0x000001ADD355C000-memory.dmp

Download

memory/2996-121-0x0000000000E90000-0x0000000000EC1000-memory.dmp

Download

memory/2996-122-0x00000000011D0000-0x00000000011DC000-memory.dmp

Download

memory/3172-151-0x0000000000F40000-0x0000000000F71000-memory.dmp

Download

memory/3172-152-0x0000000000FE0000-0x0000000000FEC000-memory.dmp

Download

memory/3176-133-0x00000000036E0000-0x00000000036EC000-memory.dmp

Download

memory/3176-132-0x0000000001C20000-0x0000000001C51000-memory.dmp

Download

memory/3188-70-0x0000027AA14D0000-0x0000027AA14DC000-memory.dmp

Download

memory/3188-69-0x0000027AA1400000-0x0000027AA1431000-memory.dmp

Download

memory/3188-71-0x0000027AA1540000-0x0000027AA1552000-memory.dmp

Download

memory/3192-149-0x0000000001D90000-0x0000000001DC1000-memory.dmp

Download

memory/3192-150-0x0000000003740000-0x000000000374C000-memory.dmp

Download

memory/3308-159-0x00000000017A0000-0x00000000017D1000-memory.dmp

Download

memory/3376-106-0x0000000000850000-0x0000000000881000-memory.dmp

Download

memory/3376-107-0x0000000002190000-0x000000000219C000-memory.dmp

Download

memory/3684-67-0x0000000002680000-0x000000000268C000-memory.dmp

Download

memory/3684-66-0x0000000000D50000-0x0000000000D81000-memory.dmp

Download

memory/3704-120-0x00000000034C0000-0x00000000034CC000-memory.dmp

Download

memory/3704-119-0x0000000001B70000-0x0000000001BA1000-memory.dmp

Download

memory/4304-156-0x0000000000F50000-0x0000000000F81000-memory.dmp

Download

memory/4304-157-0x00000000029B0000-0x00000000029BC000-memory.dmp

Download

memory/4352-20-0x0000000001450000-0x000000000145C000-memory.dmp

Download

memory/4352-19-0x0000000001670000-0x00000000016A1000-memory.dmp

Download

memory/4388-104-0x0000000001660000-0x0000000001691000-memory.dmp

Download

memory/4388-105-0x0000000001870000-0x000000000187C000-memory.dmp

Download

memory/4444-139-0x0000000001460000-0x0000000001491000-memory.dmp

Download

memory/4444-140-0x00000000014E0000-0x00000000014EC000-memory.dmp

Download

memory/4892-111-0x0000000000750000-0x0000000000781000-memory.dmp

Download

memory/4892-112-0x00000000020B0000-0x00000000020BC000-memory.dmp

Download

memory/5016-145-0x00000000026B0000-0x00000000026BC000-memory.dmp

Download

memory/5016-144-0x0000000000E70000-0x0000000000EA1000-memory.dmp

Download