3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VelocityLite.exe
Size 18.6MB
Sample260729-nbdwraself
SHA256 3867a2b72d32cf68210086edf0c94305578c3dbadbeb3f2bdabb3f79888bd9f7
MD5 69674db1e8505fc001ba1bb544ffdfcd
SHA1 10b7d17291d38a6fc5280c5db2e071290a53c068
SHA512 b3d9d78c3a4369f6b948ba7f49f2259c5d59fbfceed6c989345d8fae762e4b343e814cc1b424eccc82d75ee4b7cd892b0f6aa7819ea03425a1d609955341636d
SSDEEP 393216:pdtwpHrmXuabdwVorMb975j+ssedCCxr0DGfRJ9A8q:pTwpHrI1gowb975j+SCCxQJ8
TLSH
T100171247F389DE2EE25B1B3686730394A6359CA1BF5B030FA41A76B8AD733C01D146D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5436	VelocityLite.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
53	api.gofile.io
56	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2760	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297973223718153"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
5340	7zFM.exe
5340	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3892	OpenWith.exe
5340	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
5340	7zFM.exe
5340	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1136	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
3892	OpenWith.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
4512	AcroRd32.exe
5436	VelocityLite.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 3572	680	chrome.exe	97
PID 680 wrote to memory of 3268	680	chrome.exe	98
PID 680 wrote to memory of 3268	680	chrome.exe	98
PID 680 wrote to memory of 2760	680	chrome.exe	99
PID 680 wrote to memory of 3576	680	chrome.exe	100
PID 680 wrote to memory of 3576	680	chrome.exe	100
PID 680 wrote to memory of 4780	680	chrome.exe	102
PID 680 wrote to memory of 2472	680	chrome.exe	103
PID 680 wrote to memory of 4780	680	chrome.exe	102
PID 680 wrote to memory of 2472	680	chrome.exe	103
PID 680 wrote to memory of 4992	680	chrome.exe	104
PID 680 wrote to memory of 4992	680	chrome.exe	104
PID 680 wrote to memory of 1992	680	chrome.exe	106
PID 680 wrote to memory of 1992	680	chrome.exe	106
PID 680 wrote to memory of 3004	680	chrome.exe	107
PID 680 wrote to memory of 4044	680	chrome.exe	109
PID 680 wrote to memory of 1700	680	chrome.exe	110
PID 680 wrote to memory of 3816	680	chrome.exe	111
PID 680 wrote to memory of 4788	680	chrome.exe	112
PID 680 wrote to memory of 4788	680	chrome.exe	112
PID 680 wrote to memory of 1324	680	chrome.exe	113
PID 680 wrote to memory of 1324	680	chrome.exe	113
PID 680 wrote to memory of 4008	680	chrome.exe	114
PID 680 wrote to memory of 4008	680	chrome.exe	114
PID 680 wrote to memory of 4464	680	chrome.exe	115
PID 680 wrote to memory of 4464	680	chrome.exe	115
PID 680 wrote to memory of 3964	680	chrome.exe	116
PID 3892 wrote to memory of 4512	3892	OpenWith.exe	127
PID 4512 wrote to memory of 2916	4512	AcroRd32.exe	129
PID 2916 wrote to memory of 5004	2916	RdrCEF.exe	133
PID 2916 wrote to memory of 5092	2916	RdrCEF.exe	131
PID 2916 wrote to memory of 5092	2916	RdrCEF.exe	131
PID 2916 wrote to memory of 1232	2916	RdrCEF.exe	132
PID 2916 wrote to memory of 5004	2916	RdrCEF.exe	133
PID 2916 wrote to memory of 3516	2916	RdrCEF.exe	134
PID 5340 wrote to memory of 5436	5340	7zFM.exe	137

C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe
"C:\Users\Admin\AppData\Local\Temp\VelocityLite.exe"
1⤵
PID:4792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86e75c728,0x7ff86e75c734,0x7ff86e75c740
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,17390511743690023336,9852315843323070746,262144 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,15022777014587419835,17414629287085206111,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,7075392379438019564,18245952075088553775,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,5034170969701754176,17319649262195373963,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,12908488633862956871,7113282839693657831,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3932,i,16023776781721673027,9972536422468836879,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,1397310338788509684,6517712906798372448,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,12261579461539515926,15702471190370570567,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,10082786334489163249,16218226751969445406,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,2880129154606472795,2353637620447877729,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,11680361728220474115,7789734843099957794,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5528,i,8124530099751953911,16536380993008229175,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5532,i,9359226805455767953,7810981336763412781,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3236,i,3889150881067535761,2418380647532635560,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3356,i,7245903739670454157,14146017195893512998,2097152 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,17694768530822338085,10199085395217746430,524288 --field-trial-handle=1952,i,3522159958244882427,14496059724752284876,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:3964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Velocity.7z"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BDCC4412BF1566CE055F031BCB4A41C8 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A86EC68D05D1F2F24342F9377E679FEC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A86EC68D05D1F2F24342F9377E679FEC --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1B3D30FF6AD7EFF1132C591258EA2C6E --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=44CE35C21C30443109415D7EFF1349EC --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F6838750B44902EF3005AF143E80AD82 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5260

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Velocity.7z"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Users\Admin\AppData\Local\Temp\7zOCD4E920A\VelocityLite.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCD4E920A\VelocityLite.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 88982ffd4f1d55b7abaf7fac53045f4c34063fe49b09d20fc5f01245242aaacd
MD5 5b5385c0f95784f0993e72a3dae320a5
SHA1 1f903ac777222b4ac930612146fbc396bf7981bd
SHA512 4e8943637d92d21cd0f0ae63494b623cff3a53430e4e67ad3a3ac0edfd5f74b479dc636324888eca18430aa57923f982e6c06e57c9397b65650baf52f2e5ea76
TLSH
T14CE02B79C922EC3B19FC175868654749EA41131726409C4F773D960C8FB4B3A468685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 aae73ede9fced53f8d18381c0d4e25da842ee2d0306884575e4b680623d0f98b
MD5 f8d57642f4573e10d660e62781267be9
SHA1 6aca9ea81d9daec5c2c90cbf3ce26315b06d41f6
SHA512 4749f274a8b9a18c8b7ad77121be8be646a04c025eb4394820bae70813cf0a067928881fa9a183d517b603b6ed70fe11d1f622e569c063625b26541c5d89d234
TLSH
T1DF01A4110945C381EFE7763783C2ADA0343202303B3F0DD3FC0181B062A874110C021C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 063b5175673368fbf4aaa1069d301ee18a776d69defef960bc90df73f706edc8
MD5 76058ff02d59c44c8a8b754dd490cf9f
SHA1 427d72418491ba395cee8ecb04891c943c371a68
SHA512 e46f3df30aa0c001cdf325550a493c74c98b0e065c850ee2f90c2c494150a81238491ae31caf0c8a10c249f98d96d174c09b41d175045345ed772d8da76a6e28
TLSH
T10261AAF7C3E8857E891192F8AB116E1FCD6A1524432C3D6689D46E1B93E2972D10434F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e06bc738d31b22291f5aedc65c1a6798dfa971e0b00511f0c3c8acd41ba6a068
MD5 5fc62a976bff8189e75def8a278a0230
SHA1 e66f2786e610b0664d60b22a3a1b8459475f52de
SHA512 8cb4a4b2fe3bc3a83d61208b53647d08742e556d8e08f13d21a61fafeaf8dd96be3747a439f9dcc4904e6599d88a2f81af98a25521976c22b97b186b110eb7e9
SSDEEP 192:gRnhq27oqZWhDv7MF+pAPRp2S9HHsb+WNneU0+kVu2WMA8VyIsnAUgraJ:gRnhvox7goUX91wB0XVu2WMve
TLSH
T1DB42B62EAA15697B6CDBD229FD627F57D7F5102221C41E84EAFC8A1C05E76CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ad4ba60edd5027398ef2952b607890abd83fcef38ae0ef97c669df321ae2e6ed
MD5 6cf21976efe9c3e071f021c685c7fb7e
SHA1 328eaa075d1c9baff5d760c1fa20c4155a9c9665
SHA512 0275aa5ecdc2cc40b57c74a96f93f0fc35cb3baec7cc047198da39ebfdb8e6c511a7a56c4d23e9bafeda6a1fedc8e0196b3529aab3698280bce728abc939d321
SSDEEP 192:gRnhq27oqZWjDv7MF+pAPRp2S9HHsb+WNneU06kVu2WMAwVyIsnAUgtaJ:gRnhvoz7goUX91wB0TVu2WMn8
TLSH
T1D842A52EAA15697B6CCBC229FD627B57D7F5103221D41E84EAFC8A1C05E76CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4fef3c9d0e8314192db129f3fe0df71f28d219983b5597501f2399961e81276a
MD5 2c160253fa2e44f8a7cfb85f2298ae55
SHA1 93228b234253a93bb2112562729a5afb12a69019
SHA512 0381ecaa723fbb31a66d22def8322047027afbfca786597884f304f283382a9adc4eedfe68989d101fb6834b6c39225ad1317295311ed4d10d1d141f2fb38869
SSDEEP 192:gRnRq27oqZWUDv7MF+pXPRp08ly9HHsb+WNneU3N72IkVu2WMAQVyIsnAUgraJ:gRnRvok7go5XO1wBR2xVu2WMFe
TLSH
T1A152A42EA91469BB6CDAD229FD527F17E7F5102262D41E84EAFC8A1C05E76CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4669dc1323379cb64fabc54d8234e575894711fca0df2a31432fef11459c7e9f
MD5 639e3403b36a21a8d3098ca3a85e68fb
SHA1 0729bcb61657edc3c8226055e997a778b09e1368
SHA512 d67f39bc6e195e2c42d47eade550f8609decb6a2c4dff0204093880473d364dc521bf70f764cc282a11f973688ebdeb1248e8d59f148f9fa252a721e4be14439
SSDEEP 192:gRnhq27oqZWUDv7MF+pAPRp28ly9HHsb+WNneU3N72VkVu2WMA8VyIsnAUgraJ:gRnhvok7goUX01wBR2KVu2WMve
TLSH
T1BC52B72EB91569BB6CDBD229FD527B17E7F5102161C41E84EAFC8A1C05E76CC221701F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 59cf1fe499abc5f968deea4c87dcf1ca28a8f6e456b1693cd7e54e85255b9b31
MD5 82eb15317d14de3ea1c8c3e285baafb6
SHA1 670df82f734bb2a28673735de9b26b8d237e9a26
SHA512 b721cab32431597401698b6de29cee23fa0b4cd5417dd69b092ab780c563d604a585273106f38670479de9d9753d3b10096b1b8f690ee81f5b9e65dd0a59fa90
TLSH
T14CB0124080419211C14306F8119398887118AF10AA4B170143E0E9278C251A081140A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592d40.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592d40.TMP
Size 96B
SHA256 db48f76b88a0121814d602c7b88b17217d5fb167809b171fa0b4ace470cbe7c3
MD5 7b7d0d41ded00013c1162880ee3e3f05
SHA1 2d384e92cc35ec1f89cb37fcb7671baab683b834
SHA512 d1b47cd8cda04d941847369eadd98f48b4b36039072a5f8f31252f012335337d736117cfac79718ea0b997ddfeb5a7db16439cea45b061512e7460c6c2461326
TLSH
T114B02200C002AB02C00203B028C0A2C830A0CF2AC203222282E00A22CC222328028020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 f55663b7db287a008ef9c3a86deb739e6200817f5482d20070d3ddb37eaa7126
MD5 be28ec0f750312374abd92fb1a189f74
SHA1 4c4d56b382027424c3c356931081ff21b3daa1b3
SHA512 1c52368a83d9605de24cd9ae4c7654002e11e44bb6fcf406bca2f29c9108accfa4c96ac145be84ee4557e831efd52331ca9e49119a92aa8bbecc5067a5e80438
SSDEEP 6144:EuKkyBtza5n1+IuA+9wCUedCjm7Rkm1tYpBeh2BAod:EpBtdRAoeYCS9oBGcAod
TLSH
T1803412376E38AD3225F97B5C608E171B5CF07BA6DD25A9F4C1C83A08A2D74945D4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 492688a0dcb52f1837c3d0b0a7d87bf0298f9d6263422e9cbfc7b10b2d63edb1
MD5 fe528b403db94be3ec21ca856c864f23
SHA1 cc7078943d40936b5fe43724b9ffbc3487b3f7eb
SHA512 dd1edea9a589734235a9a82bc7381b12dc4caf347f33079ca116f87505be3574255401bfc7a31d679c14b79c2b16f00f401eb4db3ae73d03d9ca45842366053a
SSDEEP 3072:/eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:/5m7Rkm1tYpBeh2BAox
TLSH
T119C3122B5D75EC3759B9B71EB04E0B1F1EF149A6D820DE92C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e8f370319f5b89e3a0942cb4aac05ff9323048834fca418bf13c6d315d1d96d0
MD5 d0f59225c3e75aef717cdf1ae850925b
SHA1 1e7038a5559b378f944269a889a011ce3012b08b
SHA512 5dfe6ee7772bb429feb20893ccc35ce7eae6d4df64e0204441ce5cde95134eca19857dc3b7b60d5c5adad5b714b1540e25b9774da3ecb560acda49b2ac85819c
SSDEEP 6144:EfkyBtza5n1+IuA+9wCUedCjm7Rkm1tYpBeh2BAod:EjBtdRAoeYCS9oBGcAod
TLSH
T12F342227AF3CAD3225E9775C608E4B1F9CF166A5DC25AAF481C47B08A3D35D42E4DC28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 78e3be657a6ff4572a07a86efb4eb9b446f7252c8a6d269b10cfa35b893293e0
MD5 72090e21188ccecf5c94b0be737f4e21
SHA1 39477925ed456d5048260dd9f35740729e0a4054
SHA512 e7c2f86abef477ae8490fec3c49d88f42b1f9994816ba54e33ed868e3463e53223f6bfcdab97171b40568426ca0bdf2738fb3fcae2643c549e185b51dc77eccd
SSDEEP 3072:/dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/0m7Rkm1tYpBeh2BAoM
TLSH
T1A0C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0c7ca9945ac6db569870e5b9041e67fb0e9e2a85376478ecc56f1580d49962be
MD5 b1cc2c66926a2b059825becf9e666728
SHA1 596273067bc120fbff251339d90724e15a0f4a0e
SHA512 2a7ea6f70948e2b9e2153d7d728d1d8f147c12fcf20b651fb72d1f6f8c4effae303913bf6299281b81cc287a86460f97bae4974d470f7d463a7b6fff000bb890
SSDEEP 3072:keGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:k5m7Rkm1tYpBeh2BAox
TLSH
T114C3122B5D74EC3759B9B71EB04E0B1F1EF149A6D820DE92C8D85B0423F97CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VelocityLite.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCD4E920A\VelocityLite.exe
Size 232KB
SHA256 c4c0b8e1593bc5481521cecfce00b953e3ee6d7323b98e7ddf2e8c90a78ce545
MD5 e4df8ee6e755c3da3088701eb1c05b76
SHA1 c52dbc1190b84555e27649b9b54746b958e5f3cb
SHA512 623ae06db60f42e33c6e94b4d74a20d6e456a1edb94e2b8bc58424532f27bc5baa516465cad455bddc0351e21614d4965919a123b7cb0891b8527021928a09d5
SSDEEP 3072:IlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwG7NzaAT56Q7BQz:UAIwxrI14Q3kYBTM5QNQ
TLSH
T185341903B65890BAE1A2D638CD928981E7727C594F71A6CF37507B7E0F766D09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velocity.7z.crdownload

Path C:\Users\Admin\Downloads\Velocity.7z.crdownload
Size 19.7MB
SHA256 f27865ff8f60776ebd4febc0d8528aa3530396d4e4534ebe2b4f765e047b05aa
MD5 34be7067f85591003987566f89d44875
SHA1 7f748c3bda15f3d0e4fde3328256dba7362cec91
SHA512 4b3e5ad786992074a46467e85cb9eaec2de7d729d804ec358ab4c0e239a4a5d463464ba8d203cd8057eb45d2dd9f1ccda5db6784b4180a3fa4ff52a5066f7213
SSDEEP 393216:xR3TMYTPpaIJz3HJedxrwR8+6k2MTYIh8ogjpH/yo+5JUYvaQTzVmeOj12BT:LoYjJz3HJePkR8XvIYIh8ogh/4vaqzHT
TLSH
T1EA2733F8AB8CF8ECB7C73B687D857AC900D446E34249CB30A967A724F2715A651F9530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download