1149f23a081dbb9f0a86d3b284f4eaab98b1cb745fbd6c35c0a048a1be9197e3

Analysis

max time kernel
151s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.5MB
Sample260808-dhe3aayera
SHA256 1149f23a081dbb9f0a86d3b284f4eaab98b1cb745fbd6c35c0a048a1be9197e3
MD5 a35a4bfbf2ad718edd0a747e62806aeb
SHA1 48d25f07c996bd957aa8f30ea65f76f15357c1c7
SHA512 e0783bf494433642869afb67a541cd144aff138fd994affe16d12946de1f5c0c5ae81970b458ae6a33a6c1e14c39b854dc782e267af49eaa03cae47d7ad23b9e
SSDEEP 786432:Jymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDd:0Q72CWcxLcdaDy7zlhDUmOR/EHzwSMwh
TLSH
T18DA7332EF2B600DDD1636078882AA229F3357DC66B94C4CB9A4E8D067F632E0DD77355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4720	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
4720	svghost.exe
4844	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Loads dropped DLL 34 IoCs

pid	Process
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe
4720	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svghost.exe	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
File opened for modification	C:\Windows\svghost.exe	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4720	1432	2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe	89
PID 4720 wrote to memory of 4844	4720	svghost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 630KB
SHA256 c75b644b8153ca785e8bc23e376b5028aaee99c9d716fa66b0799fb4fcce0ee8
MD5 d0f1add1a46f90f58468a1642bf790df
SHA1 e7ea682290b72a990917575a0625882e9c1e6087
SHA512 781f4d9262fc4dbdf060f1d79dffc43da794bca5c48b6af06dd5cb79c40e71b7315352677c62dd51115d2a72b01310909ba39a6018d7a92f99d67842a86fae7e
SSDEEP 12288:TYWIXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:TzY0Le5ji0hmxNrM
TLSH
T1FBD40916F6748335D073C0B9C5D2A68AED7130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 94c1a48f3d18e79e02bf2eeca6a055396345e15e9ee6e2ab21e5ef2427aff61d
MD5 8b8dddce192914e8c171c2aec3426247
SHA1 5dc306bdc38886855138c0eda5ab5186224ccd14
SHA512 2d21e26773859e419e42d3ab97df540577d20c3d985a7e367cc0a3aeae73c0468e9b690f5f722cb1a7e0879cf0d98691fc6a6ba8d0fd9d172df9378129c7ef45
SSDEEP 12288:UkVyYWf8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:lkzca7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T18A35F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 773KB
SHA256 467a6d892084d17c0e94d747d70a0dc7ca546372cd2b3e25b7f919a82929f679
MD5 e790d21ebe39137f4be3da84da45894b
SHA1 bd49d4b404c0f31b3af54059882f95ef4a518bca
SHA512 89580decb24c775a478e208384df51371bcf04935035e96b172848045818605b8729e01fc093c1f3c306973507d16bc7041a76e6ba7f5869528d0af42b462215
SSDEEP 12288:UkVyYWsVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:lkzsVbqPb88hv/l+7
TLSH
T1A3F43B66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 14KB
SHA256 2ffa1c010889dc2c03dfef2271343ac6032c3966530c383b92d3dfd99a3aadc5
MD5 5dfdda860ba69df0ae0ab193cf22a4ad
SHA1 631c3b573b87688a9c5c5f9268fa826b315acb22
SHA512 ba844e4157d1da80879d89d52155e10f02682f34d92a5a7a57fb1d723cac66b01ff3aace379072780c01720419fd21f1f25279f6587950e9ed4c43688c284a95
SSDEEP 192:Qplw/Q3AjmqdD5KOEBrXJWRVkdQ2l+827nNHy+NXNUoynP+yJihMNV28d/o:ulgQ3655Kv1XIRV2Qi4Xax+yJ+MNH
TLSH
T1CA62D502CBA454E1FBFB0631B9FA298B5AB6BD104894DE1E47B07F9D0C34680E566357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 ba5e9dba58b5bd6e4f2abb6c410d5f4554de4740ce27682ab87e593cb9bcab3b
MD5 b303d3150cd9fa77ab8f377744c7f4c8
SHA1 eac294154349bf30137ae4428e420b9718e4b1a5
SHA512 5984d447e5f586850f9c03bf8064e48deac42e932af2c509f4d825f3304fe790d3b48192aaa1b7241bb6f53fb460ac1a6163f9cd7296f5de8d252b81e3340af7
SSDEEP 6144:zOtK9f+EOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:cYWbeBNUbTVO86Uq
TLSH
T15C841A3BAE38ACD2C27A89B95B91C600E7B274314F61A7CBD175C30E9F239E05D79815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 c2b196ddbe8e0e9af47310afdd920e19f7c41e961748f62374cabe33ef8e546d
MD5 105c390ce344d860c6072ad78490dab3
SHA1 6752f7fa0b4da1b110730c35602254c804510abd
SHA512 fd73bded635ec3bb0c793b4e14904b3a3648b2f0901439b3a0c6ca282a9a55b80505a96786e4467552a8a7b773d5fc8622f4ba3bf81f79fb00b1606224313f44
SSDEEP 6144:UknVuOGK9f+EOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:UkVyYWbeBNUbTVO86Uq
TLSH
T185843A3BEE28FCD2C27A8DB857918640E77278704F61A3CBD165830E9E136E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 86e5f3f3e3d35f220d71354e1bebbe7f73e29927871e8473dbbaf91eb4206569
MD5 ac350d6f41740ce78caa08f6a3b64a0f
SHA1 59174f6da0d205b0f80541236c33180f8e97e816
SHA512 411185fa5a4f08d7377ea435a5aa191abdcec5d4e2f24b7378845500826a2f402eb36a54d4e0cae0aa9547cd3c4749b6e00dccdf2efc05a4a55b6b6376b6d261
SSDEEP 3072:xrecrS2aozwLseqW14k/EyK9fq4nzrecrS2aozwL9:wcr0XdK9fqpcr0X9
TLSH
T1BBD37D41A7A88217F9FB1F34B5F485521E7DBBC63C31C61E1889B49A2D637C09A11B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 27896f64e2df01dbd0868c154880d5fda3ed378b9d8d8071a09eb925773bccde
MD5 259251824f263572b4a54629111dc051
SHA1 0c610913f9ac0f33f72b6056204ece0b29f87fb9
SHA512 6b7d8b97da1e1301516eab9d0b5e1f09a1c58bb5666994844f837d2d68e002b36ea1f97ccc3d833b5e0824d913872d9cb0a1e87a7e32e17d33637c4015e0abf2
SSDEEP 49152:Ze+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3j:Ze+QvGAdlCEL8c/bRNw5CO
TLSH
T178165B656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 ff64274fdd53daeebe67768e5ffbb2f14d93790713183293383ed7be14dfab44
MD5 e64a730d448d60c449c601282685b838
SHA1 3b573f4294fe1f2a9edddfbca329308c6edffc8d
SHA512 aa010d50adff7b33c7da8c9c9506a55702a553bf1913e47a91079140eaa058bfe2266ac40a4a4cc9f3189d896b5ed815519e2eeb6c7d8ec41e852245f304d066
SSDEEP 49152:2+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tf:2+QvGAdlCEL8c/bRNw5CO
TLSH
T16E165C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 96c765b47ec8343e5e6a0acd2e4a817eade21772f81a36785c1de18dbef4a901
MD5 e3b270b8bcd9c8d369b07633f3115fde
SHA1 534f69932d4459d2fd884c1f39d973a6b170d5b6
SHA512 eea3c054a4efaa4ba151eddc39e348b47b39d11ac1ebf854a3b182d6f7f6e9bc6cb371fed4da5d5ec5b0401af6c37d871329abb490d5c91fa8d1375717208309
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:GUEtQevvqc2W1cpV2XI32i
TLSH
T175474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 3d09cab2345a2ff70e51553c3d6c49a826a98fc3fdbafbd68453dbba7d431a74
MD5 58b97757d3f443345ae613c82fbf4391
SHA1 a10c976c51fdb130f73e0c2144254bb1cac8a8d9
SHA512 6bca3e6b6af465f3b6ac064648e81618ddc0c0fc1362a71c715c69f15d1ba94b6c1ff53c644c09b7e1f89e85c8240a3e633b2a456736154b33bd6ee0e0436b11
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:0UEtQevvqc2W1cpV2XI32i
TLSH
T135474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.1MB
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T156A55B0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 49c745f363d9dba19fda98b57b5fc1676e31938ef5f445a72b49c146ee3a949c
MD5 44f88cf7cbd343d7a5900fd35211f62c
SHA1 d150bebcc2e4be1785e2e7e3a1698a9c79c09199
SHA512 116c4e578d99dd05425fd656898066fccb7e4219cd9f6f086f05615dea20fa04d9f2c5017f61391bcf62d049e281890108c92f2ff4337f5f9dfca59136f4463c
SSDEEP 12288:ZAZ7YWkAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:ZA9zkAhGLAIFoiwtA5l7S53f
TLSH
T14CE42981E7F951D4F5B3AA7899B6C171EA76BCA65E30D20F1260C21F1E33E509D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 6fdbfb2b33299f87f798676a158d6f0ba044a6bab4c63fbb944ba7f749537654
MD5 73ec664116b69a615d642cd213df6a0f
SHA1 f5e747a0b472760aba1adaa60a778b8b277d572b
SHA512 8c8b295a4fd90aade2cf48a394c7a1a410290e3818db319c275ca64cb8e253dc49d0fd118dd2af7ab31bfd0ac8689102dbe3c8c984735f67e581f35ee2b372e0
SSDEEP 12288:UkVyYWkAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:lkzkAhGLAIFoiwtA5l7S53f
TLSH
T1D5E42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 eb1464978b91f23bf00cb4f95ff1c9a8bcb59be40b8679ef17c3d8600e94eaba
MD5 06b307cd4a05f6e8538675f438a15551
SHA1 d132ced0ad276bb2f30cd14618d2147f5df506b3
SHA512 5c0454aabdf86f3c55ced6c886520fc91b8e8613f6e922eedc15851e95cb0e93327529d32becaf147d86f5036a0c259271d41045b02a82e4a23c44b0f30f4681
SSDEEP 6144:bmw5HEiIsC0K9f+8mw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:bmw5HEjsC0YW8mw5HEjsChNVBFgl0WDu
TLSH
T15E746C4666E818F9E6A795388687C136FBF2B8013A21DB1F1760C65B1F37361BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 34029380798652427f4055c9ed165aebdf3b84cb0a98b3d45fcd13b9743c0ed6
MD5 d70752957e26f89350768cf94fb0f120
SHA1 1476650bee69684e4c4ff2f76c70120f3d12a7ac
SHA512 f99bb12b3fcb095afbbf31c03e16574e351b16ebba9f9ddda29bb7fcc0370fc9c2b44bb6b28305021d1e384c80f18d983cb9771e24b858e1cc048f4359828c7e
SSDEEP 6144:UknVuOGK9f+8mw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:UkVyYW8mw5HEjsChNVBFgl0WDm+Cp
TLSH
T1D4749E4677A41CF9E9A791388697C536F7B2B8022A25D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 43c629f8132918681994408247343944d2b61374f45a5e28fd382bb6e7773c76
MD5 2dcf9c51a3c83902e2d88903cfec3d9f
SHA1 5b349368fc6bf59a81c5d0c95e52e056f6e79f62
SHA512 626f2e00093eb89f65f33ed575371a3f3ebaea94e35f56a65f40503e627652b727e5897dcc19c5ac9532eb7a90b5f5be4a1c16d3869e8b145a07f976763f5007
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4Ikv57OsX2T3TH0XzZP1Pwe8UXDCsCy1+:UknVuOGK9f+y57L2DTH0Z1Ie8YDfvat
TLSH
T14604CF5A33E430FAE2A34238D9F55A46E7727463673583CF066442AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 e9a07d2878b59ef6be5d8edcc43b8c9f99d00091153101153e10b5dee5f93c06
MD5 45c897471de5c6b6f4b4e5617c1a99d5
SHA1 c67654fae269bd95b6fd98f8d75dee96dc79b04e
SHA512 ed5d63f6b1c4e10fc0f8c6a40fcf3275f722446561fef529d2176b74fc4a43a065996f51b5578943b21804c80238be6aa9bc536b8e9d8a88c9d62f13da8211c3
SSDEEP 3072:8vJ9psmeIBcV8pu/EyK9f+4OvJ9psmeIBcV8pQFq4XKF3QP6:83psmeI+s4K9f+t3psmeI+sQFqT3Qi
TLSH
T11D24C10AD29801E8C06EA279C7965A41F3777C6683E193CB13D0F53E1F766D09EEA643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 662158a264bdc203a479def55a19e395f5fd81560becf1e73296d3881e88bc3b
MD5 503756fd8e5ae6b2fce9b5788bffc5a0
SHA1 5f6cf91afc007f83655d014200f4f0e490d90c2f
SHA512 1ae0c13b9cd0548c904b4e5398ff36e7bfc91fe84af201b2b622de18ed6c8ffb4519a9b902bf595a9b3023f1c976e3d404c2453b8c00df281e11c47700a2ac31
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4OvJ9psmeIBcV8pQFq4XKF3QP6:UknVuOGK9f+t3psmeI+sQFqT3Qi
TLSH
T1F424591AD29802E8C06E6275C7568A41B3373C6297E1D3CB53D0F53E1F766909EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 ac6fbd1466a49e5970ae60860fc60f13accc5e422639374c5e194ea7a819ac76
MD5 cb502596c0cbcbe5e274ac8a5f9d4a6a
SHA1 ed90e6526dc6844d50adafa04674beb5472c7f49
SHA512 2c6f82e9a6827531dee28622179a1ef81d7877b50abaff0fde41698d8d0d4cddfea8705427d4b832325ecf8b823b3a23b098d53fcf2139ea2910203c77c9a2b4
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4c4WJgkt:UknVuOGK9f+tJJ
TLSH
T1C6D3E10A27B600D6D46781B0C6E25B56F97DF553A72092CF0FA9C21A1F637C49E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 64KB
SHA256 8213b9d08bab963769a154eec681c0931efa401803526ba0a62d2ae2673c45cc
MD5 51b15decca5d847a24d61fa8e1b7cebf
SHA1 b8932da29d6870ee2206bbd0fbd6a076f190897c
SHA512 4d4f310a0db56b674cc291787908c286feaf358737edc2818ca6a3a43fd3de76b419ae139ece9ed1ed16106ba6d460e97f2ab3d3b15f9d0d5f48ca9bf5fa9592
SSDEEP 768:Z4k2yi+RgnjRQ/hsUnkrwFFuVSmes3ETTfjiqoumO1R9zZlhE:Z4kIvrUnkrauV8TxouBzzhE
TLSH
T145538E4413E900FAD55F42B8C1A29A06F976F4124790A6EF0BF8C62A1F53BC1DE3E785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 141KB
SHA256 4b157bd38dda8e54bd87a3117da2fd6624c1f8db4a3fd87dbc7586b31c1f7cd0
MD5 056a50a36d15debc62f3a7098b1463b0
SHA1 b1c38519caa481f6856014011b7ef9ec03d4f182
SHA512 b3359566dea8cccb338670a520c55f289d0cde8c43000e7ebe081d00f4062d39fb7197b6a4d79d416519515e26153ad431dcc27cacf3cc950e99ec05218fbca2
SSDEEP 3072:7CiyiukvvVHC6++uq3eqW14k/EyK9f+4+pw5Z/KtbmmD22RQXSfj:UknVuOGK9f+Jpw5ySuJQX0
TLSH
T16EE3E18623E200DEE16701B482A71647F979F8539BA0D6DF0BA5820D1F637D59E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_a35a4bfbf2ad718edd0a747e62806aeb_cobalt-strike_elex_hijackloader_icedid_vidar.exe
Size 45.5MB
SHA256 48d0733b9b62d473b693a67ba65facf17a4a8983db976b57582e72802c0c26f2
MD5 00771ce657f48542c298f9df62ce12ed
SHA1 3f419f7d1f9304d4caff4b633929fc8677d94b76
SHA512 60d6fe30e249640ff2953751551167f5989c97f434379082bcaba9f2341d40fa80952421d6019e5b8b6fae7cdc32fed69de32fb0e03eb19b677a818147a4bcdd
SSDEEP 786432:xymbqv8l2r2H2cSDXQLcd2BWuFBKLAyomzeXqhb/UYE6uk5jzZ1spR2qsPHeuDDd:MQ72CWcxLcdaDy7zlhDUmOR/EHzwSMwh
TLSH
T132A7332EF2B600DDD1636078882AA229F3357DC66B94C4CB9A4E8D067F672E0DD77345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mlboo

Path C:\Users\Admin\AppData\Local\Temp\mlboo
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mtcks

Path C:\Users\Admin\AppData\Local\Temp\mtcks
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwwsb

Path C:\Users\Admin\AppData\Local\Temp\mwwsb
Size 630KB
SHA256 598f2b1b71142bc1b564326bc85ede778f75922276898261b9f2dbecbf87056d
MD5 c12f9aa0d9302b3c825141986fc68a45
SHA1 7795313a16780012b9451b02a6709edbfbc6120a
SHA512 820a34f7a331ca397efa594098418e8d45388c2a26f3c522b76d139515bdbee4df4e6651b218b85d83caffca6e2dc178954fb339c6c9def7e00ebd1ceb33bd18
SSDEEP 12288:UkVyYWIXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:lkzY0Le5ji0hmxNrM
TLSH
T13CD41A16F6748335D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

welio

Path C:\Users\Admin\AppData\Local\Temp\welio
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 286ff7d832d7afcc066a5abb6043a7ddec8b18d32d86569afa8143e3b3a57593
MD5 214659bf57f833fa7f0ce177e771e7c7
SHA1 f7b7b94034892f91e68661c6d736e687ca4cdac2
SHA512 c26373e69e6c4a1c10c31b0c71b2509312ebf1897b05f06dc06472f8454330f19a7512f9406ec6c1d41c81425b84ee259904f1e81aa7a22831385635d4848ab7
SSDEEP 1536:wA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IA3:7CiyiukvvVHC6++uq3eqW14k/EyK9f+A
TLSH
T1CB83126B2B43700AD6A25134775F2BE4913D0AB3FE7C974A4B82509E1B8E32D5D26F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1432-9-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/1432-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/1432-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1432-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4720-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4720-46-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4720-47-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads