Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe
- Size 2.0MB
- Sample260813-wfcs9adj81
- SHA256 5330c4c80a1288486a6361d916f92a42eb86275f4c2dbabde07470174c1af1c9
- MD5 cddf77efe148a9efc09687ad4bfd871f
- SHA1 98fe52a0feb5daac1c8c7b3233719ed805edf2d0
- SHA512 d2f3c7b496d73efac4e4f1d92f58c0dcb3f24c5198060da3e4e29e78b4e11eb630859c79c58929ed62051a9aab756f2c7aebe9a458e32105377d2deb8fcd127e
- SSDEEP 24576:DxbuhVZ5DOZe0p4Ek4niOkl/A04szE87JKTvmp5fhYTqMi8CtBd2QHCHmTBW5k:Dx4fD2eW4SkZP4sz9Mbo5AqJtb2I7
- TLSH T108951A15F5B88332D0B3C0B9C5E6AA99FE3234455B308ACB124AD76C2E376D6C536736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\label.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\kdnicctrl.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpresult.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\iotstartup.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\diskperf.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.26100.1_none_8917e9dc16872bc9\easinvoker.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_d691427f65d1362f\aspnet_regsql.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\chcp.com- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\msdt.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_67309bf6fa5abf27\runas.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\r\PhotoScreensaver.scr- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\odbcad32.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\FESearchHost.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\BioEnrollmentHost.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\TpmTool.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1_none_b53c1c347378366d\setup_wm.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\CustomInstallExec.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WebExperienceHostApp.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\winhlp32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\logoff.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ARP.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPUEX.EXE- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\r\dsmgmt.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.26100.1_none_17ee58fea8875a62\wmlaunch.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1591_none_324c8f3af62cc63f\dtdump.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\CredDialogHost.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\sethc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\r\DsmUserTask.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_8ee5d84e72880b3f\vbc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\fixmapi.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_ccee7580f3b9f072\MpCmdRun.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\licensingdiag.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\r\mmc.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe- 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_cddf77efe148a9efc09687ad4bfd871f_amadey_elex_rhadamanthys_stealc_stop_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.9MB
- SHA256 6b53eff6777910387f7af330c2493f04b7191f185a1cb68cff1457a5c3e2a38d
- MD5 ea1132bad6a452124a7cc2f6516baa87
- SHA1 2640fe463fb7cdae96debac3e25342d2afaf8673
- SHA512 c4d47aa3dfbc4c65b18276973e57b8a1897e266b8559f92a8c8bfafed41ce4c12448a3e24fe3ab60ccffbf60e4cd6f5fb5cd15510e99e558356719bf9328cdd8
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9Mbo5AqJtb2I0/ezSC6vUzPvMHjyR:7fkZc4APezSC6v2XMHY
- TLSH T14CE50915F5788333D0B3D0BAC5D6AA9AFE3234465B308ACB024A976C2E277D6C536735
- MD5 SHA1 SHA512 SSDEEP TLSH