57089f8de7070c0622660a7404c1f725e684ab31970ebf0ba2dae3dabbdaabc4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 883KB
Sample260806-bp71jawsbt
SHA256 57089f8de7070c0622660a7404c1f725e684ab31970ebf0ba2dae3dabbdaabc4
MD5 a0c6e74b92a1218bcab7066cb8a5e95c
SHA1 66054057ab2a5b46dae2c06e6ae097c952701d6c
SHA512 c133ebfd8d4e41cd7cd6976729c06d00058be80314bf1b324dd8188fa6d09a4bf6615e1291247be91ec0670751347a41d970106262f45ce8f5b4825c68ff18da
SSDEEP 24576:lkzmptLoxtBPgAtQf2KTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKKU:2E8hIgzKTKK4KKDyK5FZ1EEEEmEEE1EC
TLSH
T12415492A2595D1E4F7E6B2748A06A5F0D7767C261B31E2EF02B071660F335D3CE36A21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2804	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
2804	svghost.exe
2064	2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe

Loads dropped DLL 34 IoCs

pid	Process
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe
2804	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
File created	C:\Windows\svghost.exe	2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2804	4628	2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe	89
PID 2804 wrote to memory of 2064	2804	svghost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 25d0335f7543e3cc05a1d191c37f244394efc7397d3ca1aa5403d78dcc8f581a
MD5 8db63df2ab90b46429dee6b5042f5de6
SHA1 f8b1aedcead2e190e0ff11e4bdabe32bb99927ad
SHA512 68a2c364169d7275007cb1591ec377526b263a0609a0c8080242706d2191cb659024978e7b17664fbb47377172452970691b048ba2a65e819f5aff2b9cd048fb
SSDEEP 12288:vXZNYVLeyUji0h90ZD0wxpGZIVuUIVuKrHs:h0Le5ji0hmx0rM
TLSH
T183D40916F6748335D073C0B9C5D2A69AE972308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 963KB
SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
MD5 004d7851f74f86704152ecaaa147f0ce
SHA1 45a9765c26eb0b1372cb711120d90b5f111123b3
SHA512 16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29
SSDEEP 12288:O8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7a7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T1F225E815F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 aa9de1f518ddde2e17cbe2e48d02d82b90dc883ec8946dd8c42761854a53d9f7
MD5 4f5fc2d2d59eaa6eec74ac19ddf9a903
SHA1 d8ddab04b21308e9afe78e48c47778f0f80c24a5
SHA512 b28ed0ef1309896f3978aa8ad4a41c3fed3662fb380cfc5e11ad86b4a75678a5d633b45b36bdc6e663c64c8ec203d495fd8218d300fe145e33c6912416604642
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14KB
SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
MD5 5dfdda860ba69df0ae0ab193cf22a4ad
SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
TLSH
T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 c2b196ddbe8e0e9af47310afdd920e19f7c41e961748f62374cabe33ef8e546d
MD5 105c390ce344d860c6072ad78490dab3
SHA1 6752f7fa0b4da1b110730c35602254c804510abd
SHA512 fd73bded635ec3bb0c793b4e14904b3a3648b2f0901439b3a0c6ca282a9a55b80505a96786e4467552a8a7b773d5fc8622f4ba3bf81f79fb00b1606224313f44
SSDEEP 6144:UknVuOGK9f+EOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:UkVyYWbeBNUbTVO86Uq
TLSH
T185843A3BEE28FCD2C27A8DB857918640E77278704F61A3CBD165830E9E136E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 86e5f3f3e3d35f220d71354e1bebbe7f73e29927871e8473dbbaf91eb4206569
MD5 ac350d6f41740ce78caa08f6a3b64a0f
SHA1 59174f6da0d205b0f80541236c33180f8e97e816
SHA512 411185fa5a4f08d7377ea435a5aa191abdcec5d4e2f24b7378845500826a2f402eb36a54d4e0cae0aa9547cd3c4749b6e00dccdf2efc05a4a55b6b6376b6d261
SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9fq4nzrecrS2aozwL9:wcr0XdK9fqpcr0X9
TLSH
T1BBD37D41A7A88217F9FB1F34B5F485521E7DBBC63C31C61E1889B49A2D637C09A11B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 64KB
SHA256 b0909b4ff0420455a2950253c76124e76bbe42ed7523ae8e4a7202a133715317
MD5 373c33618d4b596c15055b6aef6b7f17
SHA1 715a676671ea352282aadd27790d8f247c1ef27e
SHA512 05c39fba75847de0d1c2d615c16b961d03d410aad1c8b1dd08d72dff1649da6a162a4d00cdc6e7b28b46dee8bd0f0c6781398fe00df04a6aad35412bee4a5c83
SSDEEP 1536:sgIIiz8uWxhB/YgzrvnQXAfnxozLkvh0olQoHLHLFxuBV6m62hc98t:sgvG8uTTvLkvL7eQ2hc98t
TLSH
T1DD53B20C576036F9E267E4BAD60D4672F3B636168A7026434F61C9135F7A2F08B1EE39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 ef0d8268e544e8f3c5096fed0a98c2a067406c1db078fd2b5084490a94dada51
MD5 bf2c380713c7d644650dd659dd82c171
SHA1 6ab083988435bbea9f751783af95f6f5c9e0bf04
SHA512 1e215957a3dfc98ddd8503e19d11f831fec5941a3b73cf56e38e6b69b9a0015df9adf9f160dbc5e9c3fc86f88fdea57e3023acc44958237f7acb24269f4a6953
SSDEEP 12288:tAwSfxL+YMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:eMlCaewsAju
TLSH
T126A47C31FB34D536D6BB0DB21B36CB1B143CAA104B651DC3E3A89D9E19702D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 1ae37529670e60227acd807aafcd6c3f26cf5b27e10a6f8dc308cdc890ff3d75
MD5 9afb5cc501a2fe21631bf0c8c8bdbf07
SHA1 6dd1ad7828812266bd6624d7e8efe95c16e646d8
SHA512 e92cc9f155898ca5b3e0c39d6533eda20718f201b574109934a08eb38177767f86229c09eaa237ecaa018f2998fa8dc5bab65f614d4ae4f0b9c14bdc5fbaafdc
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:lUEtQevvqc2W1cpV2XI32i
TLSH
T14F474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 16ee6468c1983cf22e6cd3060ee818997d868033834993cf80f7c06f5df3a1da
MD5 4559e4c90885f1c3795048f29b33df7a
SHA1 d7052f81077764023b0995bd14992bf3d0002da1
SHA512 e2d20e588dfed1145e3c33893226bfc0360a84d2087c54ff5fda288c52502b3e6c19564f43eca6eb24606c1cf178b9c217196ac974d94fb35cbeb30abdbf67a9
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:HUEtQevvqc2W1cpV2XI32i
TLSH
T164474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 da29bbec5c0910d4c238fd405497aa3b0cefe1dc4aa654d47428a71085e34dbf
MD5 dbbbf00ee8e32f5c1f3a2806dca3a493
SHA1 81adfe77e80933b6bc14fdcb10f61e2fb1e4f0bb
SHA512 937844f26435b073039e0a30be22c0e275c4169beabdc3806f0d911ed95a6723ee80a1ff0bae826fd52d47d3cf98ad1a32a40a0bedff14b16031d55fd77fa841
SSDEEP 24576:lkzzCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:2/CbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T1D7B55C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 8c5fe41d0ccefd51db3743f57d90c40edc1467b249ad5b9f22a097a6c546349e
MD5 349dd36239afcaa808d8026355d7331a
SHA1 d225ca3b785507f92df57e11b0940b031258c797
SHA512 bef0aa996fbb4378b22e2c0387cf75941ecbca3ddd6cfed0afcd218bfbae0d9ade1d2d769267db2d71655c2dd2f816babc81833822221af4bb5b86e2049d1940
SSDEEP 24576:GCfzzCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCf/CbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T13CB56C0976B882E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 6fdbfb2b33299f87f798676a158d6f0ba044a6bab4c63fbb944ba7f749537654
MD5 73ec664116b69a615d642cd213df6a0f
SHA1 f5e747a0b472760aba1adaa60a778b8b277d572b
SHA512 8c8b295a4fd90aade2cf48a394c7a1a410290e3818db319c275ca64cb8e253dc49d0fd118dd2af7ab31bfd0ac8689102dbe3c8c984735f67e581f35ee2b372e0
SSDEEP 12288:UkVyYWkAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:lkzkAhGLAIFoiwtA5l7S53f
TLSH
T1D5E42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 34029380798652427f4055c9ed165aebdf3b84cb0a98b3d45fcd13b9743c0ed6
MD5 d70752957e26f89350768cf94fb0f120
SHA1 1476650bee69684e4c4ff2f76c70120f3d12a7ac
SHA512 f99bb12b3fcb095afbbf31c03e16574e351b16ebba9f9ddda29bb7fcc0370fc9c2b44bb6b28305021d1e384c80f18d983cb9771e24b858e1cc048f4359828c7e
SSDEEP 6144:UknVuOGK9f+8mw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:UkVyYW8mw5HEjsChNVBFgl0WDm+Cp
TLSH
T1D4749E4677A41CF9E9A791388697C536F7B2B8022A25D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 96KB
SHA256 18b510c72c99f49d25aab59bfc99529b5c48d9f8c57c5119d187818f17ce8edf
MD5 f5aeb920f15f4a6f0df6a16aec1588fc
SHA1 0938bdf86b0071f7d691b2bee03b943fc09defef
SHA512 f1052a385be49825977f95c0dcc0d7335b25b5bfda8191d49acc73bce2dd1363200fa95c6119361d3f1d89e0594e31d20efb61a6e9d3e9776c70fa6a7f1b311f
SSDEEP 3072:qkv57OsX2T3TH0XzZP1Pwe8UXDCsCy17EM9laRYq:557L2DTH0Z1Ie8YDfvat
TLSH
T14DA35C9A33E430F9E2A3523CD9F55A46E7727452277283CF126446AA1F23BC15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 43c629f8132918681994408247343944d2b61374f45a5e28fd382bb6e7773c76
MD5 2dcf9c51a3c83902e2d88903cfec3d9f
SHA1 5b349368fc6bf59a81c5d0c95e52e056f6e79f62
SHA512 626f2e00093eb89f65f33ed575371a3f3ebaea94e35f56a65f40503e627652b727e5897dcc19c5ac9532eb7a90b5f5be4a1c16d3869e8b145a07f976763f5007
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4Ikv57OsX2T3TH0XzZP1Pwe8UXDCsCy1+:UknVuOGK9f+y57L2DTH0Z1Ie8YDfvat
TLSH
T14604CF5A33E430FAE2A34238D9F55A46E7727463673583CF066442AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 662158a264bdc203a479def55a19e395f5fd81560becf1e73296d3881e88bc3b
MD5 503756fd8e5ae6b2fce9b5788bffc5a0
SHA1 5f6cf91afc007f83655d014200f4f0e490d90c2f
SHA512 1ae0c13b9cd0548c904b4e5398ff36e7bfc91fe84af201b2b622de18ed6c8ffb4519a9b902bf595a9b3023f1c976e3d404c2453b8c00df281e11c47700a2ac31
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4OvJ9psmeIBcV8pQFq4XKF3QP6:UknVuOGK9f+t3psmeI+sQFqT3Qi
TLSH
T1F424591AD29802E8C06E6275C7568A41B3373C6297E1D3CB53D0F53E1F766909EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 ac6fbd1466a49e5970ae60860fc60f13accc5e422639374c5e194ea7a819ac76
MD5 cb502596c0cbcbe5e274ac8a5f9d4a6a
SHA1 ed90e6526dc6844d50adafa04674beb5472c7f49
SHA512 2c6f82e9a6827531dee28622179a1ef81d7877b50abaff0fde41698d8d0d4cddfea8705427d4b832325ecf8b823b3a23b098d53fcf2139ea2910203c77c9a2b4
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4c4WJgkt:UknVuOGK9f+tJJ
TLSH
T1C6D3E10A27B600D6D46781B0C6E25B56F97DF553A72092CF0FA9C21A1F637C49E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 1c74f81eeaac1b21bbd0a3a485a1ef57cec25f15010f7282830c9538b4db3c99
MD5 0061ac28ddfc5e90c8d6c5c6553d06e0
SHA1 239a682fddd1393d17458f112f928ff848321a80
SHA512 6fcec8d61befc490835d89272a813d2c5c678d00b004fae69dce05e1e9d88e8baf7a97ab660789f4ddd7aacab6e69d5423725366aecaec684cf34ee3d7cca69b
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4ckIvQnkraVTxoQG:UknVuOGK9f+Dk3nkraVT8
TLSH
T18AE3E14513E600EAD25B4278D2A35A45F57AF42387A0A6EF0FE5C21E1F53BC0DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 141KB
SHA256 4b157bd38dda8e54bd87a3117da2fd6624c1f8db4a3fd87dbc7586b31c1f7cd0
MD5 056a50a36d15debc62f3a7098b1463b0
SHA1 b1c38519caa481f6856014011b7ef9ec03d4f182
SHA512 b3359566dea8cccb338670a520c55f289d0cde8c43000e7ebe081d00f4062d39fb7197b6a4d79d416519515e26153ad431dcc27cacf3cc950e99ec05218fbca2
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4+pw5Z/KtbmmD22RQXSfj:UknVuOGK9f+Jpw5ySuJQX0
TLSH
T16EE3E18623E200DEE16701B482A71647F979F8539BA0D6DF0BA5820D1F637D59E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-06_a0c6e74b92a1218bcab7066cb8a5e95c_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 802KB
SHA256 d6ff948ffb8d8072dcb21b40af995d21b8464b37beccec933adbde35a45ba7e3
MD5 fe07957f4d49dc0014cfa94eb884396b
SHA1 98e958400cdb52762c4ed951f2dc7a526e1ae501
SHA512 9db85c0cd6c981b2c0a5da8ed842e046b3114ed68d11b56f048e8645019902cf0345e54ed6a190912695a0d060a09822c7224d383e75c2da660b26b03aa2559c
SSDEEP 24576:tptLoxtBPgAtQf2KTKK4KKDyK5FZ1EEEEmEEE1EEEEEEEEEEElKK1KKK1KKK1O:x8hIgzKTKK4KKDyK5FZ1EEEEmEEE1EEL
TLSH
T12505282A2565D1E4F7E6B2748A06A5F0D7767C261B31E2EF02B071660F335D3CE36A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pascw

Path C:\Users\Admin\AppData\Local\Temp\pascw
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pqbrb

Path C:\Users\Admin\AppData\Local\Temp\pqbrb
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qohor

Path C:\Users\Admin\AppData\Local\Temp\qohor
Size 630KB
SHA256 598f2b1b71142bc1b564326bc85ede778f75922276898261b9f2dbecbf87056d
MD5 c12f9aa0d9302b3c825141986fc68a45
SHA1 7795313a16780012b9451b02a6709edbfbc6120a
SHA512 820a34f7a331ca397efa594098418e8d45388c2a26f3c522b76d139515bdbee4df4e6651b218b85d83caffca6e2dc178954fb339c6c9def7e00ebd1ceb33bd18
SSDEEP 12288:UkVyYWIXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:lkzY0Le5ji0hmxNrM
TLSH
T13CD41A16F6748335D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 286ff7d832d7afcc066a5abb6043a7ddec8b18d32d86569afa8143e3b3a57593
MD5 214659bf57f833fa7f0ce177e771e7c7
SHA1 f7b7b94034892f91e68661c6d736e687ca4cdac2
SHA512 c26373e69e6c4a1c10c31b0c71b2509312ebf1897b05f06dc06472f8454330f19a7512f9406ec6c1d41c81425b84ee259904f1e81aa7a22831385635d4848ab7
SSDEEP 1536:wA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IA3:7CiyiukvvVHC6++uq3eqW14k/EyK9f+A
TLSH
T1CB83126B2B43700AD6A25134775F2BE4913D0AB3FE7C974A4B82509E1B8E32D5D26F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2804-17-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2804-46-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2804-45-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4628-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4628-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/4628-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4628-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads