1149f23a081dbb9f0a86d3b284f4eaab98b1cb745fbd6c35c0a048a1be9197e3

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.5MB
Sample260808-dhe3aayera
SHA256 1149f23a081dbb9f0a86d3b284f4eaab98b1cb745fbd6c35c0a048a1be9197e3
MD5 a35a4bfbf2ad718edd0a747e62806aeb
SHA1 48d25f07c996bd957aa8f30ea65f76f15357c1c7
SHA512 e0783bf494433642869afb67a541cd144aff138fd994affe16d12946de1f5c0c5ae81970b458ae6a33a6c1e14c39b854dc782e267af49eaa03cae47d7ad23b9e
SSDEEP 786432:Jymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDd:0Q72CWcxLcdaDy7zlhDUmOR/EHzwSMwh
TLSH
T18DA7332EF2B600DDD1636078882AA229F3357DC66B94C4CB9A4E8D067F632E0DD77355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4876	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
4876	svghost.exe
4508	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Loads dropped DLL 34 IoCs

pid	Process
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe
4876	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\E:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
File created	C:\Windows\svghost.exe	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4876	4896	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe	84
PID 4876 wrote to memory of 4508	4876	svghost.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 78d3ae7eb8e332b276cee2704e1291b43203f49a4649104cccddca3845295770
MD5 adf5c8e4523243d8b8286a5930fbe3cc
SHA1 c2a3379abe1e859cfe926433320e70857407d780
SHA512 ad3d19d62b700d0e789a8fc0e4978efb78a45015e9a4fd691204b61a07b5bac9678a1e6ca4f463956f809d0e3c5736c8c2846889bb091ba369b83671d797194a
SSDEEP 12288:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHsT:h0Le5ji0hmxNrMT
TLSH
T107D40916F6788735D073C0B9C5D2A68EE971308257308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 963KB
SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
MD5 004d7851f74f86704152ecaaa147f0ce
SHA1 45a9765c26eb0b1372cb711120d90b5f111123b3
SHA512 16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29
SSDEEP 12288:O8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7a7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T1F225E815F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 024837745441c48a547c3e6f0ded2e38d1a7313dfd5a9974540ad4511f0debf3
MD5 31ba7f6e67ec17528ff29669327d5b04
SHA1 2f62cdd9a68f978afb1d0ee0ceecc7e3825e0780
SHA512 4638072655c7006d15c266552d75d7fd9f427d268b0bb89a523dfadc1a08bcf2213e22272bfae38096a031a077e0fb0f8fcb4f7612b5c7a92cd6f7dd7b91b0aa
SSDEEP 12288:9VJjBq33vb5O8Mw+l1D0hwsEBoW/lx4Zf0Im98:9VbqPb88Yv/l+7
TLSH
T1D0F41A66F5748331D073C0BAC5D2A69AEE32344257318ACB0286D76C2F67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 0eb578259648cff09b2e1f0a85304ca3623cc3c6b40c7087a0c39860d7ec9115
MD5 a938096fd8b2fb9d9fdc1a0e4b51b4af
SHA1 6e26f4348d2d34ac68440bdc37814142574f84e3
SHA512 6e94aaeb71d35fe121709599009f7bed2e3d132957c5a7636d606d725380db429a9372a8ffb452dfbbec70ba770ffb526c58ea7c1c830bc74792e5b173e8704b
SSDEEP 12288:9VJjBq33vnYWsVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPnzsVbqPb88hv/l+7
TLSH
T19BF42B66F5748331D073C0BAC5D2AA9AEE32344257318ACB0246D76C2F677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14KB
SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
MD5 5dfdda860ba69df0ae0ab193cf22a4ad
SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
TLSH
T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 c2b196ddbe8e0e9af47310afdd920e19f7c41e961748f62374cabe33ef8e546d
MD5 105c390ce344d860c6072ad78490dab3
SHA1 6752f7fa0b4da1b110730c35602254c804510abd
SHA512 fd73bded635ec3bb0c793b4e14904b3a3648b2f0901439b3a0c6ca282a9a55b80505a96786e4467552a8a7b773d5fc8622f4ba3bf81f79fb00b1606224313f44
SSDEEP 6144:UknVuOGK9f+EOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:UkVyYWbeBNUbTVO86Uq
TLSH
T185843A3BEE28FCD2C27A8DB857918640E77278704F61A3CBD165830E9E136E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 128KB
SHA256 12c2312c6bbdd0f714e6cdbbf144850efe0d2a1702933184e7cef89c64416513
MD5 ca9ccb8ba1906b1c4c94e217df2a4159
SHA1 69532a2d4fecc7b8bdcbbcbbf70873995096bb96
SHA512 71b9bffbd69998d34b96b80cdea2f010a56ce8ece8d289da9c6249ce0d5a7f1f8a682f0c99407d78eb928b0687af27109661f28fb55bc928a17418eeb9658b35
SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9f+4XrecrS2aozwL9:wcr0XdK9f+hcr0X9
TLSH
T1B6D37C41A7A88217F9BB1F34B5F4C1522E7DBBC63D31C61E1889B49A2D637C09A1173B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 6c15d73b7fe6dad3cb1753a3921df28b369c2ee9cf7f30d08fdaff3da83483d5
MD5 0af1e2febe47947e457e65dcd8d99c7a
SHA1 21bb253853992004454b0d58378fe0be1dca0028
SHA512 355157213ff26d83b2f4314aa501270892011bf0703d7c6a4e744d4add9b97d59885f13eb866bbe5f671a106f88b009f57da801928a4e44b842094c049b832da
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3THI:ZQvGAdlCEL8c/bRNw5C9
TLSH
T1AB164B656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 6a9d166e76ff5c01b74b8aa5ca241406b238d9f437d5a3a91ae90833bf49481e
MD5 4a3f70325c5532fdcb8e73fcfbfcbb25
SHA1 0a611ded3d581f267e3f81005b7f967e5e6dcafb
SHA512 b71dba24219ab1c9babf004744180d753f3c9f6adbfc2ff5ae8691d8de90a8c45c317b4e08e1fc3e8026af3deb396cc370e563f7e1c17c5545a4ca14cf2780a9
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:ZQvGAdlCEL8c/bRNw5C
TLSH
T175165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 9aa1f6f2e8a93ab00b422c5bc2a86e0c1865eada52b4075adb713d35727040eb
MD5 d3074e551217d086c3d1f02ca5808a11
SHA1 6ba53c8d566f25df446c2c7291744214d89edcc4
SHA512 0390cc8366ff6964f22bec02da5e64acd3104d92f1b287c77ac43536ad6b9f2484f4f3a528c18981b30ddbbef23aae8c6245593c895c69b8347989f56c51d3e1
SSDEEP 12288:tAwSfxL+YWEAwSfxL/2Dc3jDLLmt0LDQewsAjRE:eMzZaewsAju
TLSH
T1C4A47C31FB34D536D6BB0DB21B36CB1B143CAA104B651DC3E3A89D9E19702D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 5d2873855afa9202d72633ac848f556f564fb0ae1347cc808877803083913e0f
MD5 4be849ebc3882bfc755bb7078fa26434
SHA1 a3ea29dcd6f778e4ee695cd6b7dd77ce5a72eb5a
SHA512 893b09c8cb1cb9049487066578222fd18cf226858049969bf27c214257927bfcde51f8ea3a2b854c39041438894c42718aed3048659d141b930c5b7c7c4e046e
SSDEEP 196608:XUEzQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XUEzQevvqc2W1cpV2XI32i
TLSH
T176474B91BBE843E2E3A6953484B182B6FBB17C1E5F36A33B1139F21E1E376905D15321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 79fee9d95d0733fc559f656642081f0936c5df67bac73b4af1964f7183a0ddd2
MD5 b3e1036885aa968f459eb035ee9a979b
SHA1 3fdda4f88a78b9036b4c6d2f5a4f687893e9ac73
SHA512 ffa9e9862e3a83528dbb9b138004da908484c55d878b8cc16ce7b1d37466d7361d82c25b26833918e7ec568d091919a8a65c714a56b9b9a5158a591850584fe5
SSDEEP 196608:XUEXEBQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XUEXEBQevvqc2W1cpV2XI32i
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C1E1F35A33B1139F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.1MB
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T156A55B0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 9f848ed8003012281a87960788dc84f42d83a2a59dae93f449d2c75a3970fb65
MD5 73df3ce30f1e57e7d8abe4f2cede8a29
SHA1 eff50ae244c07ad017ad72487995910fc6eb6348
SHA512 ed9cfec3d6b9342075c8a46790861fbca54189c1726b33a092d66223608998302266d27ce6e3760a36e5b433cded884a1af9c3c643845d7cbda33ba44e2a8be2
SSDEEP 6144:kwAI7xA/GtAou6z6bsQ6u6z6bsQIFoiDmzvtA5qbh497S9BcHmD1tYFLqY/W5R0i:ZAZ/GLA6AIFoiwtA5qy97S9uaYFLq3Oq
TLSH
T1EFE41981EBF945D4F5B39AB899B6D571EA76BCA61E30C30F1260C11F1E33A509D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 d309c958aaa438d74fe7e7326351f9a1d1d8f37f2816dab76a0d9108d1cc20ce
MD5 dd95e03f3613f9dc0ce31702e9235b84
SHA1 306b6b17ee76bbcc3f41eb5c8e3d55800e675278
SHA512 8539f5d8a0a50540e2b6ee6aa5d8fd3610b21285f59470c132a518006d55ce1f32e66323e8570e867f5cb4879c0a98efdb47ff95147c646623030de5aa0c7dc9
SSDEEP 6144:bmw5HEiIsCCINUGBZjgXwYz4WD5jgXwYz4WDZSFxgHiGfE:bmw5HEjsChNVBFgl0WDlgl0WDm+Cp
TLSH
T169746C4677A40CF9E96795388597D536F7B2B8022A20DB1F0760C75BAF33351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 34029380798652427f4055c9ed165aebdf3b84cb0a98b3d45fcd13b9743c0ed6
MD5 d70752957e26f89350768cf94fb0f120
SHA1 1476650bee69684e4c4ff2f76c70120f3d12a7ac
SHA512 f99bb12b3fcb095afbbf31c03e16574e351b16ebba9f9ddda29bb7fcc0370fc9c2b44bb6b28305021d1e384c80f18d983cb9771e24b858e1cc048f4359828c7e
SSDEEP 6144:UknVuOGK9f+8mw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:UkVyYW8mw5HEjsChNVBFgl0WDm+Cp
TLSH
T1D4749E4677A41CF9E9A791388697C536F7B2B8022A25D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 6aafb7d5bb2ffaef60e71e28e395e5e5dde8dfb31891003925bbd87728a6bd13
MD5 975b998a51433cd60bbacf01a68ff91f
SHA1 c9c523f1abdad3628d6e2026bb13ea2c01512d94
SHA512 48d4cf453009d56e9e133582ef087721e5cc3c55fe7fb0bcb184baa001f69450f33d497070da994884a2e627a5a2da7bff1b35fa8b5b23262f37aec02197eb42
SSDEEP 3072:qkv57OsX2T3TH0XzZP1Pwe8UXDCsCy17EM9laRYh3TH0XzZP1Pwe8UXDCsCy17EH:557L2DTH0Z1Ie8YDfvauTH0Z1Ie8YDfS
TLSH
T1F6045B9A33E420F9E1A35238DDF19A46E7727852577283CF166443AA1F23BC15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 43c629f8132918681994408247343944d2b61374f45a5e28fd382bb6e7773c76
MD5 2dcf9c51a3c83902e2d88903cfec3d9f
SHA1 5b349368fc6bf59a81c5d0c95e52e056f6e79f62
SHA512 626f2e00093eb89f65f33ed575371a3f3ebaea94e35f56a65f40503e627652b727e5897dcc19c5ac9532eb7a90b5f5be4a1c16d3869e8b145a07f976763f5007
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4Ikv57OsX2T3TH0XzZP1Pwe8UXDCsCy1+:UknVuOGK9f+y57L2DTH0Z1Ie8YDfvat
TLSH
T14604CF5A33E430FAE2A34238D9F55A46E7727463673583CF066442AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 662158a264bdc203a479def55a19e395f5fd81560becf1e73296d3881e88bc3b
MD5 503756fd8e5ae6b2fce9b5788bffc5a0
SHA1 5f6cf91afc007f83655d014200f4f0e490d90c2f
SHA512 1ae0c13b9cd0548c904b4e5398ff36e7bfc91fe84af201b2b622de18ed6c8ffb4519a9b902bf595a9b3023f1c976e3d404c2453b8c00df281e11c47700a2ac31
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4OvJ9psmeIBcV8pQFq4XKF3QP6:UknVuOGK9f+t3psmeI+sQFqT3Qi
TLSH
T1F424591AD29802E8C06E6275C7568A41B3373C6297E1D3CB53D0F53E1F766909EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 56KB
SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
MD5 8e4a401d4862a3ab07d4e7e17cbdfc78
SHA1 8ff6d2c100a2ba9b8159b9f733da011c8e448534
SHA512 74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579
SSDEEP 768:cQ6XULhGj8TzwsoeZwVAsuEIBh8v603eQdWu/idw1R9zZb3:SCVbTGkizguid8zR
TLSH
T15D437D0A67B900E6E46B81B4C5E25A47FE7AF552231196CF0FB8C21A1F637C09F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 64KB
SHA256 8213b9d08bab963769a154eec681c0931efa401803526ba0a62d2ae2673c45cc
MD5 51b15decca5d847a24d61fa8e1b7cebf
SHA1 b8932da29d6870ee2206bbd0fbd6a076f190897c
SHA512 4d4f310a0db56b674cc291787908c286feaf358737edc2818ca6a3a43fd3de76b419ae139ece9ed1ed16106ba6d460e97f2ab3d3b15f9d0d5f48ca9bf5fa9592
SSDEEP 768:Z4k2yi+RgnjRQ/hsUnkrwFFuVSmes3ETTfjiqoumO1R9zZlhE:Z4kIvrUnkrauV8TxouBzzhE
TLSH
T145538E4413E900FAD55F42B8C1A29A06F976F4124790A6EF0BF8C62A1F53BC1DE3E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 60KB
SHA256 b9f519a9b6b129464e7a9b349e40aadb5de40dc8c6a4ebee43997293b07c14b0
MD5 179199a2d5113344848be9a9142e7a92
SHA1 a216515623f22fca86695e47d78d6c19956861b3
SHA512 99faefb02e82b3a3db233ceb594cb7b1ee35a1f2aab537170d8762905dd83c5808b00caa66f3385b4e46a3b662c2ee1689e48d2aff68380e9001205f2b0fbac3
SSDEEP 768:ApwLsWZ7D774wTlENE9Kb8lS8i73PWG01Ekks3uN2wP22NjQtaOY7Og9zn:ApwLsWZ/4Ntb8lxmD22RQcOSfzn
TLSH
T1E1538D8522E900EEE16B41F8C1B35647FA75F85217A0D6DF0BA882091F637C1DE3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.5MB
SHA256 48d0733b9b62d473b693a67ba65facf17a4a8983db976b57582e72802c0c26f2
MD5 00771ce657f48542c298f9df62ce12ed
SHA1 3f419f7d1f9304d4caff4b633929fc8677d94b76
SHA512 60d6fe30e249640ff2953751551167f5989c97f434379082bcaba9f2341d40fa80952421d6019e5b8b6fae7cdc32fed69de32fb0e03eb19b677a818147a4bcdd
SSDEEP 786432:xymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDd:MQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwh
TLSH
T132A7332EF2B600DDD1636078882AA229F3357DC66B94C4CB9A4E8D067F672E0DD77345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

famai

Path C:\Users\Admin\AppData\Local\Temp\famai
Size 4KB
SHA256 ecd0c3c3490c7f05ebc48c9788c6e8ca9ebc41e4e8ca18f18fd0cb53104b8467
MD5 91926a4d1077fbec549badb734004a13
SHA1 3914d16516a42140daa33554abd579ca3f377d44
SHA512 b2921a70f55c705e9a17c330313ba1a133f00069debbf71ce69115dc3ebdbdb6c7cd335b2d56197d9c09727ecfc4ed28bf1ebeaff96dbca4c3e5461721f9e4a6
SSDEEP 24:GVIIIIIIIIIIIIIIIIIIIIIIIIIjBawBaVwaKETawJvmyWMSWI/fgfm3CKv4p3Il:+lDk/8E
TLSH
T1AE915BF082F578A4F1153477B5D4B23837C4BD4ECC51A4F6E799B98AF4618C221E9A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 286ff7d832d7afcc066a5abb6043a7ddec8b18d32d86569afa8143e3b3a57593
MD5 214659bf57f833fa7f0ce177e771e7c7
SHA1 f7b7b94034892f91e68661c6d736e687ca4cdac2
SHA512 c26373e69e6c4a1c10c31b0c71b2509312ebf1897b05f06dc06472f8454330f19a7512f9406ec6c1d41c81425b84ee259904f1e81aa7a22831385635d4848ab7
SSDEEP 1536:wA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IA3:7CiyiukvvVHC6++uq3eqW14k/EyK9f+A
TLSH
T1CB83126B2B43700AD6A25134775F2BE4913D0AB3FE7C974A4B82509E1B8E32D5D26F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4876-20-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4876-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4896-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4896-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4896-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/4896-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4896-11-0x0000000000427000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads