Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
- Size 2.0MB
- Sample260820-wa65xaeh39
- SHA256 9b6f159fa2b70a3fb17c09d679706c1ab2c82512d935e3e0aa9e2b0ff56956da
- MD5 6c1f40d0dee3f29277353164a5312cea
- SHA1 ad62c7617143330e576b83804d4fc9c7b69b4345
- SHA512 1fe5d8f7741e3b6a8769d4a486d853825109f550d29bf0d2241a81a067b260fd62c834f3df74cc06be1f61387ed5d02a3b9e9ef83b5e053f80eeaff362a71f4b
- SSDEEP 24576:DxbuhVZ5DOZe0p4Ek4niOkl/A04szE87JKTvmn0Le5ji0hmxNrMg:Dx4fD2eW4SkZP4sz9MbePji0Aj1
- TLSH T16DA51A15F6B88332D0B3C0B9C5E6A69AFD7234455B308ACB0249976C2E377D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\w32tm.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\control.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\format.com 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\user.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\at.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\FilePicker.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\r\powershell_ise.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsv.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\hvsiproxyapp.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1_none_d2c8c6a3035feb05\nslookup.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_877dba7dc10bf8a0\RmClient.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\explorer.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.26100.1_none_3182dffdaeb31123\SrTasks.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\replace.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\perfmon.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\splwow64.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\colorcpl.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.26100.1_none_0c15b158e639a4e7\icsunattend.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\cscript.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_e9f03efdb03c43d2\dsacls.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\r\edpnotify.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\r\PkgMgr.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.26100.1150_none_44d0a2970b0871bf\r\alg.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4uinit.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\LockAppHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\r\ComputerDefaults.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.26100.1_none_8917e9dc16872bc9\easinvoker.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1_none_5449f71c20d1e235\at.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\AggregatorHost.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\colorcpl.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5422b42832d51a31\label.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_603d466a5482ab50\Register-CimProvider.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\r\mspaint.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_6c1f40d0dee3f29277353164a5312cea_amadey_elex_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2980
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.9MB
- SHA256 686e0cd3fa1757eb71cc1cf788354c8c0ce33d6d995bcf068b5e8515f4a76e36
- MD5 b49d27897d85e85b1af6a2138dd02fd8
- SHA1 7f6fe59d99430bffed22714922171907cc2b3790
- SHA512 0974ea771c542841c385571f461b6791e770873c86fc951767551d66884169063471c48c3e3e1a46cefb59ccb84aff91be7e8e5bbc2e285006b78c5e6de4fea0
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbePji0AjO/ezSC6vUzPvMHjyt:7fkZckjoOezSC6v2XMHo
- TLSH T1DBE50A15F6B88333D0B3C0B9C5E6AA9AFE7234465B3089CB0246976C2E277D6C536735
- MD5 SHA1 SHA512 SSDEEP TLSH