Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe
- Size 1.0MB
- Sample260511-sd7ztscy4y
- SHA256 b97741917e34ac26da79fe1a045ca794fdd89fb715b52eebbccb94e38ab5bd69
- MD5 2e3fd9f105bdd1fd2cc49b7fd989760b
- SHA1 f2c7d1fa06daa7349d65d358619281d8e5bfef9a
- SHA512 d340b0f89237daaf93cd0120384c0e2f378f70a25cd37b01180271324be160950a1e2ced9f8abdbcc2a14aa25344fe4366760a965695e1f435c7ce48866ad836
- SSDEEP 12288:DxX2H+uhEa/fZ5Doaplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5/:DxbuhVZ5DrYTqMi8CtBd2QHCHmTBW5/
- TLSH T124354C15F6A48331D073C0B5C5E2A69AEE3238415B30CACB538A976D2F776D2D53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\choice.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\relog.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tar.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mshta.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\reg.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.22000.1_none_2d8b0e006fd7fa09\VMCreate.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.22000.1_none_014b03c8301af3f9\WinMgmt.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\r\SearchIndexer.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.0_none_c4e73077398e975b\mscorsvw.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\OOBENetworkConnectionFlow.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.22000.1_none_12679a433ec476cd\diskusage.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_f57e785f37294fe2\f\ntprint.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_397d6ed60254bd95\PackagedCWALauncher.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\f\winload.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.22000.1_none_772ade6a0d9b8f2a\ldifde.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.22000.1_none_21929eac926a49b0\FirstLogonAnim.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\r\PkgMgr.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\r\RMActivate_ssp_isv.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\f\ShellExperienceHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\f\wowreg32.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_c1a3421d8c97478a\SndVol.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\r\RMActivate.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\wowreg32.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_bb381a0becef4d51\f\certutil.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.1_none_70fb0683c48edf32\WmiPrvSE.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\immersivetpmvscmgrsvr.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.22000.1_none_d0b58ed08fdbb9ff\cliconfg.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\r\CheckNetIsolation.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15806.0_none_995af40fe4edc5b6\cvtres.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\r\ApplyTrustOffline.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\r\OOBENetworkConnectionFlow.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.22000.1_none_58a0c8778f3217ee\unlodctr.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\ResetPluginHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.22000.1_none_8270b443c99f06ee\dpnsvr.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\f\CustomShellHost.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.22000.1_none_6cefaf05d980bc3b\UserAccountBroker.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_c5b187e40e57e8e5\fsquirt.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.22000.1_none_348c892128803a3c\ielowutil.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\WindowsSandbox.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\UpgradeResultsUI.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVDllSurrogate.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.22000.1_none_30b748e419e103b5\iscsicli.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\audit.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.22000.1_none_c4b0a2008f6c9857\_isdel.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\f\LsaIso.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.22000.1_none_f27e3cf28c93be1a\UwfServicingMasterScript.cmd- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.22000.1_none_39be32461bdf0e10\dsdbutil.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15806.0_none_a79116553d9d1dc3\ilasm.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\nvspinfo.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\f\SpeechRuntime.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.22000.1_none_e0cdafc35d48718b\RmClient.exe- 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2e3fd9f105bdd1fd2cc49b7fd989760b_amadey_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.6MB
- SHA256 1777e48f19061b761ff1eef68ed027b258543187cb4a259c999bc270e6846550
- MD5 35907da261f57d180b04a7ea2ff873a8
- SHA1 3fb8e1b777a16da75ef0936742a555e87e210fac
- SHA512 d0e0a35229536e19f3b18c75397c1ccedd7734e13e0dbe9e42f98cea4222d729584e9a47c178dc7ccdfb0d39edfad78785a4fba7188fed1da349f1fdb27e8ee6
- SSDEEP 24576:DxbuhVZ5DrYTqMi8CtBd2QHCHmTBW5n0Le5ji0hmxNrMi:Dx4fDyqJtb2IuPji0AjL
- TLSH T18E752A15F6B48331D073C0B9C5E2A69AEE7234415B308ACB538AD76C2E776D6C53A732
- MD5 SHA1 SHA512 SSDEEP TLSH