Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
- Size 504KB
- Sample260511-m6hmraf18t
- SHA256 08c6c7f70cff0a79b8c12ead5b9236c907f09274bfa5b26b4185fde93c5deedf
- MD5 ee2c7d8f04a309eb2250fc2e8e272c48
- SHA1 bff6f8a71a2b4af688e1e4f6d75d2c5ae51ed7da
- SHA512 cccb3a95160b2f6abe8bf3be89f76c2b9e66bf3ecc95506822c71aacb6a713d4e90ae2ae4b421f9d10982fece8b0d7f3d32330a3a685ff088cf2492eff5b52b6
- SSDEEP 6144:4jMKITkBXkHJTxX2H+ePlD1T/fQXAVu1a/fWYjF59bVC9n:DxX2H+uhEa/fZ5Don
- TLSH T184B49D01BAD08071E4B3057019F5B626667BBD600FB0DA4F639C3E9D1F75AC0AA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\whoami.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\format.com 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CA565693-D2C5-4BF5-BC9E-F82435F8187A}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.256_none_f3055d6fbd1168d8\ngen.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\f\ApplyTrustOffline.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.22000.1_none_bf1c03009ab5fa34\diskpart.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.22000.132_none_2eb02d05c34e2eef\WaaSMedicAgent.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\f\sfc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_aef18f12e09924ba\aspnet_regiis.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.493_none_31b28f9ae4503c95\vmms.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\f\cmproxyd.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\r\quickassist.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVDllSurrogate.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\f\winload.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.22000.1_none_d5126d2e75032b40\EASPolicyManagerBrokerHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\r\CheckNetIsolation.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\f\explorer.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\WerFaultSecure.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\r\RMActivate_isv.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.0_none_7d39f9a025126e55\mscorsvw.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCE.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\r\RdpSaUacHelper.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.22000.1_none_7e6a217fc1ce4322\mqtgsvc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\PING.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\r\hvix64.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.132_none_a52f79fedfba2bb3\r\fontdrvhost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\r\IESettingSync.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\r\audit.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_b98d3baff0bf243b\Register-CimProvider.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_8e52c12ba60f5a2c\wordpad.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_011628217859daa6\w3wp.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\r\sdchange.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\f\licensingdiag.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.22000.1_none_3c7644c59e04550c\isoburn.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\f\ShellAppRuntime.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\UtcDecoderHost.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.22000.1_none_53a76037c15099de\pnputil.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\provtool.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\f\wuauclt.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_83fe16d971ae9831\wordpad.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.22000.37_none_4ebd7bd997a97fcb\f\wifitask.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\r\NarratorQuickStart.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.22000.1_none_c2121c7e5d3f12f9\PhotoScreensaver.scr- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.22000.1_none_693149fc921dd27f\rrinstaller.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_09c9ecffc9049dc0\PING.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.282_none_3066e216e524ffb4\f\vmwp.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.SyncController.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\r\CapturePicker.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\printui.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\TRACERT.EXE- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\BioIso.exe- 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ee2c7d8f04a309eb2250fc2e8e272c48_amadey_elex_rhadamanthys_stop_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.0MB
- SHA256 6aca87a5709ea2d4df8321afdcb0992113042e187d74593e4c0c43f9f985adcb
- MD5 e88c2312f64eeb8fde9c0f80fa78bd45
- SHA1 a7a58639fbc96707177eb94384578cc66a85e23c
- SHA512 c8162198a0e394b5892c5cf79c88a3a1f6754c329351a5483ee3b3cfc50a580c29a954f240408e517a51a4f2f050aa7e5c0cc943e04fe529ff3a87d51560f953
- SSDEEP 12288:DxX2H+uhEa/fZ5DopXZNYVLeyUji0h90ZD0wxpGZIVuKrHsv:DxbuhVZ5Do/0Le5ji0hmxNrMv
- TLSH T1BF354C15F6B48331D073C0B5C5E2A69AEA7238411B308ACB5399D76C2F77AD2D636732
- MD5 SHA1 SHA512 SSDEEP TLSH