We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
2 February 2026, 21:28
Analysis environment:
Windows 10 Pro, build 19044, x64
Velostrap.exe
MD5:
3457467BB5E5BA58A09549E16FD6062D
SHA1:
C385DA6EC61889EAD01DAEE7A484BF75E1CEA505
SHA256:
061DB0A99EB8F6E9E62638DB767D33EBE11C92A2A58A08263432E192F2EAA1A2
Analysis result
Threat level:
Malicious activity
Tags:
nuitka
python
pyinstaller
Full analysis:
Analysis Velostrap.exe (MD5: 3457467BB5E5BA58A09549E16FD6062D) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
No malicious indicators.
SUSPICIOUS
Executable content was dropped or overwritten
Velostrap.exe (PID: 4304)
Process drops python dynamic module
Velostrap.exe (PID: 4304)
The process drops C-runtime libraries
Velostrap.exe (PID: 4304)
NUITKA compiler has been detected
Velostrap.exe (PID: 4304)
Process drops legitimate windows executable
Velostrap.exe (PID: 4304)
Application launched itself
Velostrap.exe (PID: 4304)
Loads Python modules
Velostrap.exe (PID: 2432)
Starts CMD.EXE for commands execution
Velostrap.exe (PID: 2432)
Reads Internet Explorer settings
Velostrap.exe (PID: 2432)
Reads Microsoft Outlook installation path
Velostrap.exe (PID: 2432)
INFO
The sample compiled with english language support
Velostrap.exe (PID: 4304)
Checks supported languages
Velostrap.exe (PID: 4304)
Velostrap.exe (PID: 2432)
Create files in a temporary directory
Velostrap.exe (PID: 4304)
Drops script file
Velostrap.exe (PID: 4304)
Velostrap.exe (PID: 2432)
Checks operating system version
Velostrap.exe (PID: 2432)
Checks proxy server information
slui.exe (PID: 6756)
Velostrap.exe (PID: 2432)
Creates files or folders in the user directory
Velostrap.exe (PID: 2432)
PyInstaller has been detected (YARA)
Velostrap.exe (PID: 2432)
There is functionality for taking screenshot (YARA)
Velostrap.exe (PID: 2432)
Reads the computer name
Velostrap.exe (PID: 2432)
Reads security settings of Internet Explorer
Velostrap.exe (PID: 2432)
Reads the machine GUID from the registry
Velostrap.exe (PID: 2432)
Threats
PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed UA-CPU Header
2432
Velostrap.exe
Misc activity
ET INFO Observed UA-CPU Header