Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe
- Size 4.6MB
- Sample260831-bbz3rssglf
- SHA256 777814e478c8b9f587d333a1df3381503eba3619d6a00cc2c4f66bcf92fa8367
- MD5 f23ff20a904efe002c05b0c21d53fcb9
- SHA1 7bd00ca805fe9255b2bb9c9cf9db262e4ab805a0
- SHA512 d1bfefaf3886de7cf85e7ef38cd0eccbba86c21d5d1663f2de5ea8fe8acf21c8cdafdd042bb46972d8376be91427cfd78c8b47012fd2a392fa9380c693ba4987
- SSDEEP 98304:BUF13joQWQCkcewpiVF9LR1zrkz6v+mEJnD:B4loQWfkcdwVDV1zrk+AnD
- TLSH T12F36D017F5A401A9D02AD07AC796A336F97278850730BACF0394D7692F37BE19B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Database Administration = "C:\\Windows\\system32\\systemDA.exe" 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\lesys.sys 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ReadMe.2.txt 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\systemDA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\nCalc.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\lzsys.sys 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\fr-ma\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\it-it\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\lists\1033\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\gd-gb\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ru\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\ja-jp\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\pa-in\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\or-in\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\qps-ploc\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\arctic\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\en-us\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ko\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\gd-gb\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\sk-sk\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\sk-sk\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\filters\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\1033\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\fren\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\windows sidebar\shared gadgets\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Playboy centerfold.jpeg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\nn-no\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\windows media player\network sharing\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 crack.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\as-in\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\es\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\mk-mk\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\1033\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\arctic\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\is-is\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\How to make crystal meth.doc .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ko\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Detroit.zip 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4420 1216 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\Hot young babes have an orgy.rar .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\eu-es\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\c:\program files\common files\microc:\program files\common files\microsoft shared\¼UZujÎÀèêdc:\program files\common files\microsoft shared\ink\tt-ru\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\fr\Weed growing for dummies.ebook.pdf .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\§`ÎÀÐàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\sv-se\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\þÿÿÿc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\whÎÀ€èdc:\program files\common files\microsoft shared\ink\gu-in\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\hi-in\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\whÎÀ€èdc:\program files\common files\microsoft shared\ink\km-kh\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Weed growing for dummies.ebook.pdf .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\‡eÎÀðådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\radial\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\cs-cz\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\mi-nz\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\it\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\dc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\da-dk\Internet Explorer 7.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\fa-ir\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\sr-latn-rs\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\compass\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\journal\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\§`ÎÀÐàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\rmnsque\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sumipntg\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\P3 leaked.pifc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\vba\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\it-it\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\layers\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\1033\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\05 Edition.zip .pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Firm ass gets pumped.avi .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\red\web server extensions\16\WinAmp 5.rar .exec:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\windows media player\network sharing\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\ca-es\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\es\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\X×dc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\1033\Kazaa Lite 2005 Edition.zip .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ader_smoke-ldc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\§`ÎÀÐàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\evrgreen\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\t office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\Windows XP SP3 leaked.pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\bs-latn-ba\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pt-br\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\s\1033\WinRAR 4 BETA.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\Anal Pleasure 3.dvd.mpg .pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\fï wCc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\lists\1033\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\1c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Internet Explorer 7.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\Hot young babes have an orgy.rar .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\pÉdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ar-ae\Windows Longhorn serial.txt .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\=c:\program files\common files\microsoft shared\ink\et-ee\WinAmp 5.rar ¼UZujÎÀèêdc:\program files\common files\microsoft shared\ink\fi-fi\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\âdc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Weed growing for dummies.ebook.pdf .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\hu-hu\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\ms-my\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\c:\program files\common files\microc:\program files\common files\microsoft shared\¼UZujÎÀèêdc:\program files\common files\microsoft shared\ink\zh-cn\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\‡eÎÀðådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\Windows XP SP3 leaked.pif 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ru\WinRAR 4 BETA.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\office.en-us\DVD Xcopy PRO crack.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\del\Windows dc:\program files\common files\microsoft shared\ink\pt-pt\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\sr-cyrl-rs\Adobe Photoshop 7 Illegal Beta.exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\àmˆc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\Windows XP SP3 leaked.pifc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\Jenna Jameson screensaver HOT XXX.scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\c:\program files\common files\microc:\program files\common files\microsoft shared\¼UZujÎÀèêdc:\program files\common files\microsoft shared\ink\kok-in\WinAmp 5.rar .exe 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\del\Windows dc:\program files\common files\microsoft shared\ink\ro-ro\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\msinfo\ja-jp\Hot young babes have an orgy.rar .scr 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe 1216 2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_f23ff20a904efe002c05b0c21d53fcb9_amadey_cobalt-strike_elex_hijackloader_smoke-loader_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 52842⤵
- Program crash
PID:4420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1216 -ip 12161⤵PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 4.9MB
- SHA256 9670f8f1f93b4a97b3a5ad4e08c7431772e93ab382a819d12801a98d3cf130fb
- MD5 523b3b93e547d29f18301d0b8f1175f0
- SHA1 5ba7218ec48a58b10271b843d333c85b834481f1
- SHA512 754b20c762f9ced2a9b5ef6f6599c2a5e00fad3e982d8feb8229141025c506a1db401f08776b66b6faefc2cc54cfde4a7545041538b6fc5dfb5b7b253d0eb6e3
- SSDEEP 98304:BUF13joQWQCkcewpiVF9LR1zrkz6v+mEJnf:B4loQWfkcdwVDV1zrk+Anf
- TLSH T16B36D027F5A441E9D02AD079C796A326EA7278550B30B6CF0390D7692F37BE09F39721
- MD5 SHA1 SHA512 SSDEEP TLSH