6fd8ae68be5e103a957250c32eae71d6a5f6495ac85ffe7d5a278d1474fe154e

Analysis

user interaction
yes
max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 14:58

Target
Velostrap.exe
Size 13.3MB
Sample260508-sb92eaat9s
SHA256 6fd8ae68be5e103a957250c32eae71d6a5f6495ac85ffe7d5a278d1474fe154e
MD5 72a63c8f2b6314ca6c58c75f6d71d462
SHA1 1d90e950c46b54fb676791768ef6fe0551a513bb
SHA512 c6c0614141f570274cf23850a59af9ca21f95db629f8a191e7b56b18c8a71396a5f161bec6f11ad4f5b140b6a338c517b5bf7e6fff7549b8f6ced84e9f0ab35e
SSDEEP 98304:yxayTscasdKQjsk+ZmD3QoOYoHwfLk3vSmaR0+Mc4AN0edaAHDfysrTlJ:ydsRsdKisk+ZYObAbN0A
TLSH
T1B7E67D8523FC2635E3FB4B35A970621E4976BC1AA812D78E1B84B61D1A72740CCF1B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	Velostrap.exe

C:\Users\Admin\AppData\Local\Temp\Velostrap.exe
"C:\Users\Admin\AppData\Local\Temp\Velostrap.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:608