Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe
- Size 221KB
- Sample260813-pefeesyfrd
- SHA256 4a850ae48518450919836f97ed0db01a7bf5883059b1add0f56e7e8575436f00
- MD5 c0bb83eadf8f964fbacbdc18af048887
- SHA1 4e850b3094a53f03d81fe17c6084be43db953539
- SHA512 ae525a2bad323a55dddcf9004da873c676c133d6ce238291b6b19d447bbd59d5f4945928e543fae273cd323851da526e4e1bd585ee127b1f4be4bf17457b5264
- SSDEEP 3072:JJw8KYg5zA5GsMYSxSJiN/vGss9kTBf9pAXAtPOYQwtge7oZ/:J035iMhL/vGsbTBl2wOstM
- TLSH T193248C2172D0C073C062147641B5C7F29E7B78751A66A98BAFCB5FB90F212D2D72A38D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\J: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\Q: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\R: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\T: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\W: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\G: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\K: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\M: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\N: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\S: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\X: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\Z: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\D: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\H: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\L: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\O: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\P: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\U: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\V: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened (read-only) \??\Y: 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\MCBUILDER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\MSPAINT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\DCCW.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TPMTOOL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMECFMUI.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\FSUTIL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\WEVTUTIL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\FONTVIEW.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\BTHUDTASK.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\REPLACE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TSTHEME.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\HDWWIZ.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SETUP16.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\VERCLSID.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TPMINIT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\PACKAGEDCWALAUNCHER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\INPUTSWITCHTOASTHANDLER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\RUNLEGACYCPLELEVATED.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\RELOG.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\EXTRAC32.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\PRESENTATIONHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\CHECKNETISOLATION.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\PWAHELPER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\UNPACK200.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MISC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPERBGT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMCLIENTICON.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-006E-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\DOTNET\DOTNET.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\7.0.16\CREATEDUMP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JABSWITCH.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\ORBD.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KEYTOOL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMADMINICON.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MAVINJECT32.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE64.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PDFREFLOW.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\MICROSOFTEDGEUPDATE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSESAMPLEUPLOADER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGEWEBVIEW2.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\NOTIFICATION_CLICK_HELPER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\MSEDGE_PROXY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SSVAGENT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOEV.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\COOKIE_EXPORTER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATION_SERVICE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ORGCHART.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SCANPST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSADEBUGD.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOUC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PROTOCOLHANDLER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\ACCICONS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\ELEVATION_SERVICE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\MSEDGEWEBVIEW2.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UNINSTALL\HELPER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_USEREXPERIENCE-OOBE_31BF3856AD364E35_10.0.26100.1591_NONE_54983D2D7A4908C4\R\OOBE\OOBEHOSTAPP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ADVANCEDTASKMANAGER_31BF3856AD364E35_10.0.26100.1742_NONE_4A8C1DF49B9AFB5A\TASKMGR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NET-COMMAND-LINE-TOOL_31BF3856AD364E35_10.0.26100.1_NONE_4F25F9E0DB03AA60\NET.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MSETTINGS-DATAMODEL_31BF3856AD364E35_10.0.26100.1591_NONE_85F1FBDAACD275E0\R\SYSTEMSETTINGSBROKER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-S..MPROPERTIESHARDWARE_31BF3856AD364E35_10.0.26100.1_NONE_4842D7F26FE7B708\SYSTEMPROPERTIESHARDWARE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_64\MSBUILD\V4.0_4.0.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AARSVC_31BF3856AD364E35_10.0.26100.1591_NONE_FEAFA9B0555EF776\AGENTACTIVATIONRUNTIMESTARTER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMERFEEDBACKMANAGER_31BF3856AD364E35_10.0.26100.1591_NONE_77F3B6BE3E383E20\R\IMECFMUI.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\HELPPANE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEENROLLER_31BF3856AD364E35_10.0.26100.1591_NONE_5D054CD1BD51EFF3\DEVICEENROLLER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ROBOCOPY_31BF3856AD364E35_10.0.26100.1591_NONE_62C72AA79C6B13FD\R\ROBOCOPY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-W..FOR-MANAGEMENT-CORE_31BF3856AD364E35_10.0.26100.1_NONE_D1ADC81249F528D5\WSMPROVHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMMANDLINE-ADAMSYNC_31BF3856AD364E35_10.0.26100.1150_NONE_8E0A1D6FCE8B1D12\ADAMSYNC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..ME-JAPANESE-SETTING_31BF3856AD364E35_10.0.26100.1591_NONE_58449D9961468D2F\IMJPSET.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_D8E83661333DA001\R\ARP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MAPI-MMGA_31BF3856AD364E35_10.0.26100.712_NONE_82C18832EFD3E8D9\MMGASERVER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.26100.1150_NONE_FD0ACB47AEBF06DB\LOGMAN.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_10.0.26100.1591_NONE_CDEC79755D491FDB\SETUP.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WIMGAPI_31BF3856AD364E35_10.0.26100.1150_NONE_24E2F2E0C4C87239\WIMSERV.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CTTUNE_31BF3856AD364E35_10.0.26100.1_NONE_BACCDF245B7274CB\CTTUNE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-EDGE-WEBVIEW_31BF3856AD364E35_10.0.26100.1_NONE_8FE1C356F34A19CA\MSEDGEWEBVIEW2.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.26100.1591_NONE_08D143C7D80566F8\R\OOBELDR.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..NATIVE-WHITEBOX-ISV_31BF3856AD364E35_10.0.26100.1150_NONE_85392E759F939EAE\R\RMACTIVATE_ISV.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WSATCONFIG_B03F5F7F11D50A3A_4.0.15912.0_NONE_65C6AB619FD35783\WSATCONFIG.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..PACKAGEDCWALAUNCHER_31BF3856AD364E35_10.0.26100.1_NONE_EA8223E29A7906A5\PACKAGEDCWALAUNCHER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-NEWDEV_31BF3856AD364E35_10.0.26100.1_NONE_18BE9E06ED967433\NEWDEV.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGBROWSERS_B03F5F7F11D50A3A_4.0.15912.0_NONE_6650E9DF0164E801\ASPNET_REGBROWSERS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-APPVWOW_31BF3856AD364E35_10.0.26100.1591_NONE_4EF9C76EA26D9C67\R\APPVDLLSURROGATE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-F..YSAFETY-REFRESHTASK_31BF3856AD364E35_10.0.26100.1591_NONE_FA6FDCD71655EC4D\R\WPCTOK.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_8097A9DCA8EE24C4\QUERY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WHERE_31BF3856AD364E35_10.0.26100.1_NONE_5AC6E18046B72D8C\WHERE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINRSPLUGINS_31BF3856AD364E35_10.0.26100.1150_NONE_B21DC6DDE1913832\WINRS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..OTOCOL-HOST-SERVICE_31BF3856AD364E35_10.0.26100.1150_NONE_26313857AE07F88D\R\EAP3HOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MANAGEDWINDOWSVM_31BF3856AD364E35_10.0.26100.1591_NONE_4C3489B778790277\MANAGEDWINDOWSVM.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_JSC_B03F5F7F11D50A3A_4.0.15912.0_NONE_2E8B40428114406D\JSC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_D8E83661333DA001\R\TCPSVCS.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ATIBILITY-ASSISTANT_31BF3856AD364E35_10.0.26100.1591_NONE_CF86813AD32DD96E\R\PCALUA.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUDIO-VOLUMECONTROL_31BF3856AD364E35_10.0.26100.1591_NONE_6C3D16DFEBE198E3\R\SNDVOL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-HTMLHELP_31BF3856AD364E35_10.0.26100.1591_NONE_6E6A9C2B69241453\HH.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PICKERHOST_31BF3856AD364E35_10.0.26100.1591_NONE_53C210DB32C306CD\PICKERHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_10.0.26100.1_NONE_B079F7BA2CC824D5\TRACERT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RUNDLL32_31BF3856AD364E35_10.0.26100.1591_NONE_7E19F7088F522C23\RUNDLL32.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_8097A9DCA8EE24C4\CHGPORT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FSAVAILUX_31BF3856AD364E35_10.0.26100.1_NONE_A7BC2B43865E8120\FSAVAILUX.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OPENFILES_31BF3856AD364E35_10.0.26100.1150_NONE_830DB7779A4E1286\R\OPENFILES.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CERTIFICATEREQUESTTOOL_31BF3856AD364E35_10.0.26100.1591_NONE_0E2538FCFBCFDDA3\CERTREQ.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-M..AC-SQL-CLICONFG-EXE_31BF3856AD364E35_10.0.26100.1_NONE_7765998AF39F4114\CLICONFG.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DXP-DEVICEEXPERIENCE_31BF3856AD364E35_10.0.26100.1150_NONE_E30C7C3AA9B12724\DXPSERVER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE-PROVIDERHOST_31BF3856AD364E35_10.0.26100.1150_NONE_AC4A0F023B4EF24A\WMIPRVSE.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.26100.1591_NONE_10F229073C0AC263\R\SEARCHFILTERHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OSTIC-USER-RESOLVER_31BF3856AD364E35_10.0.26100.1_NONE_C228AD766E3B968C\DFDWIZ.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSDT_31BF3856AD364E35_10.0.26100.712_NONE_47A47970066D8602\R\MSDT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..NSEMANAGER-SHELLEXT_31BF3856AD364E35_10.0.26100.1150_NONE_4E317F44E4F64723\LICENSEMANAGERSHELLEXT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-DEFRAG-ADMINUI_31BF3856AD364E35_10.0.26100.1_NONE_A05E61712D324FE9\DFRGUI.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CORE_CW5N1H2TXYEWY\SNAPLAUNCHERPROTOCOL.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\LKG\MICROSOFTWINDOWS.LKG.SEARCH_CW5N1H2TXYEWY\FESEARCHHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LOCKAPPHOST_31BF3856AD364E35_10.0.26100.1591_NONE_97668666133579F2\LOCKAPPHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAPI-MMGA_31BF3856AD364E35_10.0.26100.1150_NONE_723216DA827602DD\R\MMGASERVER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PROXIMITYUXHOST_31BF3856AD364E35_10.0.26100.1150_NONE_30E310BFFC56CEA9\R\PROXIMITYUXHOST.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SCRIPTING_31BF3856AD364E35_10.0.26100.1591_NONE_EE7CF88EE4C18ABA\WSCRIPT.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SYSTRAY_31BF3856AD364E35_10.0.26100.1_NONE_FA99CF8592F76FDD\SYSTRAY.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MULTIMEDIA-RRINSTALLER_31BF3856AD364E35_10.0.26100.1_NONE_1A35FF092A421B8F\RRINSTALLER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPX-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.26100.1742_NONE_FCF4914266C3A69D\CUSTOMINSTALLEXEC.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..ALENROLLMENTMANAGER_31BF3856AD364E35_10.0.26100.1591_NONE_4177DE30403BFB76\CREDENTIALENROLLMENTMANAGER.EXE 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_c0bb83eadf8f964fbacbdc18af048887_elex_rhadamanthys_stop_tofsee.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4868
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1