e65ba7ef5b0a0b33caed909460a57ccc91339fd963c5709a3a556914d64e44af

Analysis

user interaction
yes
max time kernel
359s
max time network
360s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/08/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
velosniper.exe
Size 17.9MB
Sample260810-t46ecstakc
SHA256 e65ba7ef5b0a0b33caed909460a57ccc91339fd963c5709a3a556914d64e44af
MD5 fb43f43b34e4d37507172ab3005d4ac0
SHA1 7a67339e87db616ccdfccdc43718fc3b0d22f261
SHA512 175f58485544550f13cc4015174bf0ec301389309b31698e8f18ef5459874f0a16af90561d8e4e214651e0494562d63e980c392cb7e7ce586a9a0294bc8b13eb
SSDEEP 196608:qDV22p4vcIDk4+EY3MIbnShXcXGzkDadoq:qx22qvcIDk4+EY3MIbnYXjkAJ
TLSH
T138174C67E8D215D8C4EEC574C672412BBBA23C491B3863E71690B3241F33BE09EBA755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	velosniper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_651323253\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_651323253\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1144542517\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1144542517\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1144542517\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1230961440\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1771620086\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1771620086\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_651323253\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1144542517\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1144542517\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1230961440\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5864_1230961440\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308534929446872"	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5892	msedgewebview2.exe
5892	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5864	msedgewebview2.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 5864	4552	velosniper.exe	81
PID 5864 wrote to memory of 5752	5864	msedgewebview2.exe	82
PID 5864 wrote to memory of 3212	5864	msedgewebview2.exe	83
PID 5864 wrote to memory of 3212	5864	msedgewebview2.exe	83
PID 5864 wrote to memory of 3212	5864	msedgewebview2.exe	83
PID 5864 wrote to memory of 5472	5864	msedgewebview2.exe	84
PID 5864 wrote to memory of 4732	5864	msedgewebview2.exe	85
PID 5864 wrote to memory of 4732	5864	msedgewebview2.exe	85
PID 5864 wrote to memory of 5692	5864	msedgewebview2.exe	86
PID 5864 wrote to memory of 5692	5864	msedgewebview2.exe	86
PID 5864 wrote to memory of 5692	5864	msedgewebview2.exe	86
PID 5864 wrote to memory of 3708	5864	msedgewebview2.exe	87
PID 5864 wrote to memory of 3708	5864	msedgewebview2.exe	87
PID 5864 wrote to memory of 4300	5864	msedgewebview2.exe	100
PID 5864 wrote to memory of 4300	5864	msedgewebview2.exe	100
PID 5864 wrote to memory of 5676	5864	msedgewebview2.exe	101
PID 5864 wrote to memory of 5676	5864	msedgewebview2.exe	101
PID 5864 wrote to memory of 5892	5864	msedgewebview2.exe	102
PID 5864 wrote to memory of 2336	5864	msedgewebview2.exe	103
PID 5864 wrote to memory of 2336	5864	msedgewebview2.exe	103
PID 5864 wrote to memory of 872	5864	msedgewebview2.exe	104
PID 5864 wrote to memory of 872	5864	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\velosniper.exe
"C:\Users\Admin\AppData\Local\Temp\velosniper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4552.1096.4719231180978721955
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdb250b078,0x7ffdb250b084,0x7ffdb250b090
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1820,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1920,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2212,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4008,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4976,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=776,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4920,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5892
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5044,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView" --webview-exe-name=velosniper.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5092,i,6153633150453144852,7833026481216451202,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ac13b9d3cc3bea8eaad41bea68282d3bed92fc4eda4341307dfdcb36372a72cd
MD5 c990ef4e0b71bed382f00b44973f0581
SHA1 18d3880006d7fa60617aa263606a32c63e7f4230
SHA512 ae0c4f54952a2bc3e8bc800eb6e5ecd3eb2a9e82488a210962b6d5d41418ecf762636dccc0a2cd72fb5d93d3dd34176c74d673e9bfadb1f7278a310fb10a9a4d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5ae41b03ebcc23897d3d4d41f9d19caffa7ca8584880c03a7e29184def0211ce
MD5 7f8fb3b41f57691bb55a66142700aa74
SHA1 42e1cae8807bc44ab3b66fa24b06fdc54dd99111
SHA512 389e6aafa9a680b854749444366840ceecedef7a9b2f227cb628e3c6a3f03ff8abb9f377c86bd91c9a5ad3d9f250c8a5e00daf81bda48fbcf676b169d4b7af1c
TLSH
T10DD0122232464534C03031331102710C0440CB0F400781859868961E1E094602906441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ae253cae8eb8d04c4822bdbda5e93fafae898cffece76ea51cc75b8740c32ded
MD5 b9e43d05ae3029185ce930e0f5a2fac6
SHA1 cdf6c9edfcc043ce86fab37085d48194aad2a5b1
SHA512 ffa35827e81a78f8889d255b4716029fbbfb2b291684dee7da532ab7380b94c29592868499269930eed88c27231161856fba15c80349e6be149dac9807aebf41
TLSH
T134B0124001530035C740F779B0558C203450893112C20309B3540D088D231411200C13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b011.TMP

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58b011.TMP
Size 48B
SHA256 280b24a506998281f396b4a4d3c8e1fd6991c34f29e60e6d2e1029bd29b03645
MD5 a52d7c64c3d2c2fa3cac6eb2447f5c1e
SHA1 e79ac34ccb8fc457fda842bff31b3f7893e35bf9
SHA512 6a53f75f45fe0bed1f177bb03af0b49bb7ea2d597cb95cfdf3a4ee200d559ad8d3bbd98246e59932077bde6bce9269ab622561010a0d2a9c05295da2626c777d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 64548bd0d80f263730715a5416c024fc6160ccfe8c7d35e41fe84c3484a7cb07
MD5 981016224b700f8624e67fd33f9b497b
SHA1 33892baf12e64b113f0ec04849e014a58069243b
SHA512 21b11bf6b94f3c717f459b872fd9ef6d2cf4135a1dd6aa4d29a668bf9bc31d9410fcf375ee3111e17f9d56c025b2e6f674ab637b0d98fd4d4dc68a148c813f28
TLSH
T1A541AEB7C3DC416D892152F877253A1BCD2E461A521C3E0EC8D8EBDB63E1474E250C5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595ad8.TMP

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Network\Network Persistent State~RFe595ad8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 d884026972e3ef68cbd739e10edd242c1c695a0eda63a048a7e9f607e668fb9f
MD5 28ad326da65355081bc09cb401818d3e
SHA1 2c0df9a48f281e0fa186c3ca43bf0792946c0ecf
SHA512 9b3e3e72f276e422f438ab7474ce7aba69c9efdc20ba285a245800ec851a988ca10aaf12c140d9512ee9d58fde17aced09ecdd94e0d69ae284d2e3660de8d9d3
SSDEEP 192:st+07gfqfXHZ8pad5/S+WiBFhqYPXE0+MC:stb7gSf2A/VlqevC
TLSH
T194E1A7425E6879774CCBF6197A35BB12E2FA606261D40E98EBFC861C04E66CD6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e327.TMP

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Preferences~RFe58e327.TMP
Size 6KB
SHA256 b28c9e967f295c0500caa88ccc1dfa772f87a0937030be90025859c41dd2b32b
MD5 bf973b5220119a5ca46c2d9a3fb3c783
SHA1 841f859b6c7ca9f146a2fcfd8365907d4e5ea902
SHA512 88b3f6f578709da256ae4c6f965b74aa3d47f9bfb5e45cb7002b5cc8d98e1ea4c39fbda2d9de5711aa8a20f46addfe9d0be6bc09799b59dcbec15f95540ae7c5
SSDEEP 192:st+07gfTfXHZ8pad5/S+WiBMzwYPX/0+M8:stb7gbf2A/Vywdv8
TLSH
T153D1A8425F68B9774CCBE6197A35BB16E2FA212265D40E98EBFC851C04E66CC6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Local State
Size 1KB
SHA256 92d559a3b239963283b7a971880ee6351dea77516a5afd3c963f1b115a0d7db6
MD5 88b42fc009a47bc319a3f97f71caf8b8
SHA1 c6f94d422482faa145a55ef1ee09831560b69619
SHA512 51eb2135c1df7530476663273b5b42972f10be1290baf2cae940477be576b590b975f8d32e4db9b75a42e9079cd0bf53854d75ee17b86543b31005762123485c
TLSH
T1E73185B299A067355985564AB2563F9B2E341035D2904E5CA6EE1B0801E778C9B37C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Local State
Size 2KB
SHA256 3d51add2208171cf4cccba29a376cd1930bd4dce890c900a0f1c17b99784a5f2
MD5 afb4e908276b32f599b2b33e2bb9a841
SHA1 f028f03f3d834cc05831a18dc21f2c401fa5ae84
SHA512 4541e29573c02b84eb9a50dcbc03f7a9a50c32072242aa5f2777364d6a589644edccc8a8e5346d9fd9ffdc52d82852c9d2dfc98a11bcd03f88cf60142df7eb5a
TLSH
T14851C7736850EA3789D65648BA4A3F179A39116096D12FA49AED1F0C00DB74C2303C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Local State
Size 3KB
SHA256 7ffca0f92f73c7fcf51edc584104d71430d3b53a6c614ff233ecb2a054aac042
MD5 e5e0af180a9a7e80d812777350965bd4
SHA1 f1130688a9772ef78beeee5801cafcb9aaca9577
SHA512 684b5ebaf94ed3de6f0363da683bdb1888623bc480efffc4ddfb63275379b63370bb9b7fc861459c618709b35140b6951a133eee342dc5aaaed62b1f3dc4c1cd
TLSH
T17771C8226964E93B4DE69905B9863F0AB7A91132D5D43FA8DAEC0F0C01DB38C1342C1F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Local State
Size 16KB
SHA256 0ca73337c792815f2c7e7f2fca85fd2ae9be148bcc9181719d578c86cf19c251
MD5 5b16aa57b251dba186f54ddc708efa6f
SHA1 0f5974ef9e06c76311ff612b387eaa4988e0f039
SHA512 13b976c0bbac46ae1dede1601c348938a644d50aa7136d745c6b3f334d38c93cc0a599e20df3a24900f125c9c0da0d855962e3d3de2814b36343c6ecd4cd3774
SSDEEP 384:zp+aQikB+z/xvxjg/qhEwNbXRPfiq0ee49zJ:4/UxvxjgC+axaqF7FJ
TLSH
T112729E2795687E2795F7FA05795D0B4BDBB985B280C12FBC4AED2F0906CB3980302D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5844c4.TMP

Path C:\Users\Admin\AppData\Roaming\velosniper.exe\EBWebView\Local State~RFe5844c4.TMP
Size 1KB
SHA256 b1c1e1f44777787df5ec3b3f8bc08f1092534f66b8c7e7fcf4a7a52cba92c88e
MD5 1da5ae37fa254753433a64cc1b7cde49
SHA1 b42d6983aaa14460af846345c269b3d31af1cb6a
SHA512 80e7ca49a178f5c464e6ad55cb633850abc52e2b487f05ef335c78a65ec51683d7591cb66d3a07e98ae589603c3089db7bcb92486759db65e93eed62e689df33
TLSH
T175219573C8906635A984454AB2523F8F2E640034D2905E1CE6DE170801DBA8C8B37C3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-36-0x00007FFDCD030000-0x00007FFDCD031000-memory.dmp

Download

memory/4552-0-0x0000021D7FFD0000-0x0000021D7FFF8000-memory.dmp

Download

memory/4732-101-0x00007FFDCCAC0000-0x00007FFDCCAC1000-memory.dmp

Download

memory/4732-100-0x00007FFDCE710000-0x00007FFDCE711000-memory.dmp

Download

memory/5692-116-0x00007FFDCD030000-0x00007FFDCD031000-memory.dmp

Download

memory/5864-237-0x0000026932FE0000-0x0000026933FE0000-memory.dmp

Download

memory/5892-375-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-364-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-363-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-365-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-374-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-373-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-372-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-371-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-370-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download

memory/5892-369-0x0000020A6C580000-0x0000020A6C581000-memory.dmp

Download