Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2026, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
- Size 504KB
- Sample260511-m6hmraf18t
- SHA256 08c6c7f70cff0a79b8c12ead5b9236c907f09274bfa5b26b4185fde93c5deedf
- MD5 ee2c7d8f04a309eb2250fc2e8e272c48
- SHA1 bff6f8a71a2b4af688e1e4f6d75d2c5ae51ed7da
- SHA512 cccb3a95160b2f6abe8bf3be89f76c2b9e66bf3ecc95506822c71aacb6a713d4e90ae2ae4b421f9d10982fece8b0d7f3d32330a3a685ff088cf2492eff5b52b6
- SSDEEP 6144:4jMKITkBXkHJTxX2H+ePlD1T/fQXAVu1a/fWYjF59bVC9n:DxX2H+uhEa/fZ5Don
- TLSH T184B49D01BAD08071E4B3057019F5B626667BBD600FB0DA4F639C3E9D1F75AC0AA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\reg.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mode.com- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tree.com- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\comp.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tree.com 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\help.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\help.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tar.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\control.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\psr.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevated_tracing_service.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{EF862335-677B-4B5E-9D5F-A67CDF1548F1}\MicrosoftEdge_X64_133.0.3065.69.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\msedgewebview2.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\notification_helper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.1_none_cc694aafc259f133\sihost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\wimserv.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\oobeldr.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\r\GameBarPresenceWriter.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2d66868246722e10\OpenWith.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\SyncAppvPublishingServer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\r\wuauclt.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\mofcomp.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\logman.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\r\wlrmdr.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_48cfaff3d4e720e6\ktmutil.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\diskperf.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAgentPolicyGenerator.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\f\wpnpinst.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\f\dstokenclean.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\r\DismHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.1_none_a47f90601a54e2cd\dialer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.19041.1_none_1b7ab1943757b81e\diskraid.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\r\LegacyNetUXHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_ad39955b83a3f25f\SystemPropertiesAdvanced.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.264_none_52f277f293540161\WinBioDataModelOOBE.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\audiodg.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\f\ApproveChildRequest.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\r\directxdatabaseupdater.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.1_none_bddafe5ea5731fa2\bridgeunattend.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\printui.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\WinSAT.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_d6008c7292c63a76\runonce.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1_none_45334ed1c0264cf2\wkspbroker.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ldr64_exe_31bf3856ad364e35_10.0.19041.1_none_538a6445ed07333b\Ldr64.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_0d475c3f57a2ce2b\at.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\WWAHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\r\wiaacmgr.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\r\AppVClient.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_6b92f924ed7df79b\fixmapi.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-keygen.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\f\taskhostw.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\explorer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.19041.1_none_76edadec5ba257b3\verifier.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\DiagnosticsHub.StandardCollector.Service.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\r\Defrag.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpresult.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchProtocolHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\f\PinningConfirmationDialog.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\r\refsutil.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_2e482ad4cee11ead\regsvr32.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.19041.1_none_62cddcb4116c2175\grpconv.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\HelpPane.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.0MB
- SHA256 6aca87a5709ea2d4df8321afdcb0992113042e187d74593e4c0c43f9f985adcb
- MD5 e88c2312f64eeb8fde9c0f80fa78bd45
- SHA1 a7a58639fbc96707177eb94384578cc66a85e23c
- SHA512 c8162198a0e394b5892c5cf79c88a3a1f6754c329351a5483ee3b3cfc50a580c29a954f240408e517a51a4f2f050aa7e5c0cc943e04fe529ff3a87d51560f953
- SSDEEP 12288:DxX2H+uhEa/fZ5DopXZNYVLeyUji0h90ZD0wxpGZIVuKrHsv:DxbuhVZ5Do/0Le5ji0hmxNrMv
- TLSH T1BF354C15F6B48331D073C0B5C5E2A69AEA7238411B308ACB5399D76C2F77AD2D636732
- MD5 SHA1 SHA512 SSDEEP TLSH