Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
- Size 2.0MB
- Sample260820-wa65xaeh39
- SHA256 9b6f159fa2b70a3fb17c09d679706c1ab2c82512d935e3e0aa9e2b0ff56956da
- MD5 6c1f40d0dee3f29277353164a5312cea
- SHA1 ad62c7617143330e576b83804d4fc9c7b69b4345
- SHA512 1fe5d8f7741e3b6a8769d4a486d853825109f550d29bf0d2241a81a067b260fd62c834f3df74cc06be1f61387ed5d02a3b9e9ef83b5e053f80eeaff362a71f4b
- SSDEEP 24576:DxbuhVZ5DOZe0p4Ek4niOkl/A04szE87JKTvmn0Le5ji0hmxNrMg:Dx4fD2eW4SkZP4sz9MbePji0Aj1
- TLSH T16DA51A15F6B88332D0B3C0B9C5E6A69AFD7234455B308ACB0249976C2E377D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cacls.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_825521fc8f4a22ac\fsutil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\DataUsageLiveTileTask.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.1_none_570d39e810ac0f64\WmsSessionAgent.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\FsIso.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1_none_f725ad3465e95fe3\klist.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\convertvhd.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmmon32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\user.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvax64.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\r\AssignedAccessLockApp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\r\mavinject.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_3711e18b51638445\InetMgr6.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_b0a3ebd117ec81d4\hh.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\AssignedAccessLockApp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\r\MuiUnattend.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ThumbnailExtractionHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\SyncAppvPublishingServer.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_40d14f6c04397868\agentactivationruntimestarter.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\f\UtcDecoderHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\r\diskpart.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\sftp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\SgrmLpac.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.19041.1_none_9561617494f4801d\NETFXSBS10.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\hvsiproxyapp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\f2329d4736e5d7010ba200001815341f.iissetup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\relog.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\r\PasswordOnWakeSettingFlyout.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\omadmclient.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirpcd.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\r\msinfo32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.1_none_866e293cdb38481a\SndVol.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_d6f1c935a875f141\UserAccountBroker.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_ec479f963c4c3325\ddodiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1_none_80e38b0746f5a926\wmprph.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_962bc7b24e8d9f3a\TSTheme.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_4b25f9be389a3a63\agentactivationruntimestarter.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\hvc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmstp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\SpeechModelDownload.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\f\wusa.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\f\winresume.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_dc79f03629571954\format.com- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\f\wsl.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashUtil_ActiveX.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_7e3d02e24c15fe88\IEChooser.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_a6a8b89bc50eae31\cvtres.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.1_none_a2b2be7cc3d8faf5\DisplaySwitch.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\r\mighost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\refsutil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1_none_2f60455143be03e9\notepad.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.5MB
- SHA256 56d79718fb9c68ea5347ba7e5cb47391122c6d64edacf971b247c5249328f471
- MD5 c74ac85a085e845c064415fc9c556db2
- SHA1 49f78203a68679d3354f00b37b2319d33cc3cde8
- SHA512 6e11e65b4d510abf741ee34bd36a5513aafbbdff2d30a2818fc3f3d77a7cb6c0015187cfea7088ccbe7b53884eb8484c7fad599ca83b4eec02cb72538977dc3b
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbePji0AjBPji0AjR:7fkZckjoVjoN
- TLSH T10CC52B15F6B88332D0B3C0B9C5E6A69AFD7234465B308ACB0245D76C2E277D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH