Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe
- Size 3.4MB
- Sample260416-kfvhhset9t
- SHA256 8b1b00c45568d83acbd2203fecb602d36ce9f1e865c00d2e90cb04e5c7cdc4d1
- MD5 feaf65953b3f4561c74c9abeac274c56
- SHA1 18ef6f339e0fd5d049cd4bd89ec27a55a790cb79
- SHA512 22c5d4795736bd2ee16faa1262ca6b8db3fc142e7390bfd6472ba0a199b67030c5382981b42c7a387b6c176d23fbdb8381a1540c23c9c5f48bf68f397e91c5aa
- SSDEEP 49152:kpowaeH8+Z1pmfOj9o73RgUOwD/KCGZd0qDVBXdcOpYqhPji0Aj4:kGwaeH8+Z1pmfOj83Rrw/dz6Wjo0
- TLSH T1F1F57B12B6E48235E0B3E174C9F25375EA7238925B34C6CF0385966C1EB3BD19E36762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\ScriptRunner.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\r\LaunchWinApp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_e8a5ac944557b7d6\icacls.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.844_none_3ca0ef366c7d7a84\Dism.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\r\BitLockerDeviceEncryption.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\MsSense.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchIndexer.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_5d1b02917c107c75\autoconv.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\r\setupugc.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\WindowsActionDialog.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\sftp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\r\printui.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\f\explorer.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmstp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1_none_b354d0155be50ce9\pnputil.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\changepk.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_4d9121ef47f5b52d\mshta.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.423_none_61b0f600375d52e3\UserAccountControlSettings.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_5bddc2e54ca343d3\LaunchWinApp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_433c779d1394f332\mshta.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\r\provtool.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\winrm.cmd- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\r\Defrag.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\fontdrvhost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.19041.1_none_2aa26221a7a3d549\stordiag.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_95938c4a44e792de\ReAgentc.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\Setup.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\r\ntprint.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\sdchange.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_c12e5c6c2037e719\imjpuexc.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.1_none_e768b85cf7ad062e\TSWbPrxy.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_51acbceed0728359\cvtres.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.746_none_9d44fd61d4c8aeec\SecurityHealthSystray.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_579ae2e26c347896\WMIC.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\backgroundTaskHost.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\f\MBR2GPT.EXE- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\f\MusNotification.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\setup16.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\DeviceCensus.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\WindowsActionDialog.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_7e3d02e24c15fe88\IEChooser.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiFileFetcher.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.1_none_7e470436241a018f\hh.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.1_none_bddafe5ea5731fa2\bridgeunattend.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8ade03f009f66b38\InputSwitchToastHandler.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrs.exe- 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_feaf65953b3f4561c74c9abeac274c56_amadey_cobalt-strike_elex_emotet_icedid_rhadamanthys_stop_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 3.9MB
- SHA256 003f744a5453c51839b58b5266bd655a3b891b5e14277a410ab29dce99c4b83c
- MD5 1faad162a4b20b00792937c02103660f
- SHA1 6cbeb6bf1903779b40bc3a4f25909eba54c985cd
- SHA512 3b0b398fa10fbbbeb27e21f33ff5660f761d483f9617f6432a362efef729915571a251cdae409373b48d72b23065ddfddb9203ea967bde0d58c27f5e09b24ee7
- SSDEEP 49152:kpowaeH8+Z1pmfOj9o73RgUOwD/KCGZd0qDVBXdcOpYqhPji0AjaPji0Ajo:kGwaeH8+Z1pmfOj83Rrw/dz6WjoUjo8
- TLSH T1A1166B12F6E44235E0B3E174C5F2976AEA7238425B34C6CF0385966C2E73BD19A36772
- MD5 SHA1 SHA512 SSDEEP TLSH