Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe
- Size 1.9MB
- Sample260722-3d8apswhje
- SHA256 fb54c5ad231df12c495d7888c05f57ce049c820f90e8f2ca698af79becc42be7
- MD5 b13d4eca582d3d6ec3b3f8d5901c3b9c
- SHA1 8d1032c91b3622f73e7890957612b66054f70ba7
- SHA512 bdc3b7e822273c67ac2589cf610de66d1bc3bd32a5f1653385db2d81dd61bc9244c48d87daaafcd9229609ed8e414849bce8a9c21d5fef6bc8ccc70c52724bbd
- SSDEEP 24576:DxbuhVZ5DOZe0p4Ek4niOkl/A04szE87JKTvmyYzx5YTqMi8CtBd2QHCHmTBW5U:Dx4fD2eW4SkZP4sz9MbmmqJtb2IV
- TLSH T153952A15F5B88332D0B3C0B9C5D6AA9AFE3234455B308ACB134A976C2E376D6C536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dialer.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\curl.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sfc.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\find.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\where.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.26100.1_none_627d4c710086cc28\diskraid.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\verifiergui.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\Microsoft.ECApp.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WindowsBackupClient.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\hh.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingShell.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sudo_31bf3856ad364e35_10.0.26100.1_none_a2b1ee1b85e5539a\sudo.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\DeviceCensus.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpresult.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\r\qappsrv.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmstp.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1_none_713b7d7638176261\TapiUnattend.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\taskhostw.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchIndexer.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\r\wininit.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.26100.1150_none_7a6e656d581b85dd\Build.bat- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiFileFetcher.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15912.0_none_53903386cd9b843e\cvtres.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-add.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\LogonWebHostProduct.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPUEX.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\EoAExperiences.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\r\MicrosoftEdgeSH.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthHost.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_1346e96d3ee86ee9\getmac.exe- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCLNWZ.EXE- 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_b13d4eca582d3d6ec3b3f8d5901c3b9c_amadey_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.9MB
- SHA256 12a6d4edd4cb5bd667334646bd28d15ace16b0aea84886cfb9c42ecde0712fc5
- MD5 2523a1729397fb3e2292c0fa7cbf4b51
- SHA1 a9ae23dd9bd6431952496b9d0af2d520aece8dde
- SHA512 30390e9f2901dc8f75919fe38d4b80639dcdff03c7d8780806081004e27a2a4a3097bfdc14a59c1bad796c9307365e07ba16c60a14483dc50b5fb3c7ed2b1dd6
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbmmqJtb2Iu/ezSC6vUzPvMHjyA:7fkZcXvezSC6v2XMHp
- TLSH T1E2E50915F5788333D0B3D0BAC5D6AA9AFE3234465B308ACB024AD76C2E276D6C536735
- MD5 SHA1 SHA512 SSDEEP TLSH