Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe
- Size 3.3MB
- Sample260812-xblq2aec63
- SHA256 f2d10abc283b3e20d27d966604355876e183de78781d3319b5f90c75842fa24b
- MD5 fbc07e04dfa93fad12c524dd8ecda102
- SHA1 20e4153639e705fe74bb7156ce27279aaa490f25
- SHA512 d5b6b4e12dea0343f6f1abf4a33da894eba15471235c393e435c2debcc973ebd2d0eac4885391f0211eee2030c4df0d4e22e9724e06f69f3ab4a3f2c7e2a810f
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9Mb5cWn6ue3dqJtb2IoPji0AjD:7fkZcmW6uCrjo/
- TLSH T1E2F50815F6B88332D0B7C0B5C5E6A75EFA323C815B308ACB1246B36C2E376D59536726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\netsh.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\mode.com 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\control.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15912.0_none_769e30e9239830f5\AddInProcess.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpconfig.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\OfflineScannerShell.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tscon.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\iisreset.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmplayer.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\r\NcsiUwpApp.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmbind.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmLpac.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_d691427f65d1362f\aspnet_regsql.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_bdae08941820f568\waitfor.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_4e3bd09ff189ac9a\aspnet_wp.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\r\AtBroker.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.26100.1591_none_ae6cc2a1ab3ee224\ShellAppRuntime.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_10dfbabc1234526e\ServiceModelReg.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_a98d653d335a00f2\aspnet_state.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\IMJPSET.EXE- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFault.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1_none_eb822b3ce383f6d7\dialer.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\LaunchTM.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\w32tm.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\r\VoiceAccess.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_b6996f0c07fabc7a\SMSvcHost.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasphone.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\wscript.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\logagent.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.26100.1_none_b0088cffd56138b1\djoin.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wabmig.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\FESearchHost.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_c8691d618eec1ae9\CasPol.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_fbc07e04dfa93fad12c524dd8ecda102_amadey_cloudeye_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.3MB
- SHA256 7c185c524a5de41f9ef517ee05b9666d4e5ad67650fa4c5dfbf097f7d7e68107
- MD5 eed09ea7a62188bdd8133104e0dbddc8
- SHA1 f2da53f8097d6d8c77e1f90d2c5c0156af453d49
- SHA512 34f6afa946fb6d5dfff0401c0498581b48256cf85d0086e85413cce7c9dbcf26042c443d19cbe7f847d22eabe208852867f0331df264f03c0cbc93511cfc8c59
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9Mb5cWn6ue3dqJtb2IoPji0Aj8/ezSC6vUzPvMHjy3:7fkZcmW6uCrjo8ezSC6v2XMHi
- TLSH T103260915F6B88332D0B3C0B9C5E6A69EFA323C415B3089CB1246B76C2E376D59536736
- MD5 SHA1 SHA512 SSDEEP TLSH