Analysis
- max time kernel
130s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/03/2026, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe
- Size 110KB
- Sample260311-mll5faev9l
- SHA256 e0da18d3175d5f312eb49d0ca79de633d78736370212e540c0058ed7adf7fdee
- MD5 432919b01ac22149a130f471199b6fce
- SHA1 b584b99b976b893b2d4807cbf22b2a5c97dd536f
- SHA512 377740272e6cf8d1ce102b8e48bae017ba08b80eb9b4c8558f2830eca8b721bed1b8b775edc856a4911f008fb5eb94627256f21170790cf510d26475763e3d8c
- SSDEEP 3072:WQARDoo8GKdimusNmZOGo0Y0O6E/y1G+GO8jr9RvUAyGLhYj:QuNShoGO5+c77c
- TLSH T1BAB36C03B1E19072DF720D347AF5AAA589ADFC740B14AFEBB3C4153A0E205C19635EA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\Music\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\T: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\W: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\X: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\Y: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\Z: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\I: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\K: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\V: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\E: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\J: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\L: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\M: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\O: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\Q: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\B: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\H: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\N: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\R: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\S: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\U: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\A: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened (read-only) \??\G: 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_FEMININE.pak 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-100.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.scale-100_altform-colorful.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-200.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-unplated_contrast-white.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-24.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\InstallBackup.bat 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-72_altform-unplated_contrast-white.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorMedTile.scale-200_contrast-black.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-32.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-press.svg 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-24_altform-lightunplated.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.3e53a08d.pri 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Xbox_UnplatedLargeTile.scale-100_contrast-black.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.targetsize-32_contrast-white.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-100.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmlaunch.exe.mui 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_FEMININE.pak.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.scale-200.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-black\CameraAppList.targetsize-36_altform-unplated.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-60_altform-lightunplated.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\ui-strings.js 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxAccountsSplashLogo.scale-140.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs_NEUTER.pak.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-200.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.PLAY 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-11_432919b01ac22149a130f471199b6fce_amadey_elex_hellokitty_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2256
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini
- Size 1KB
- SHA256 41dd7a9cda35ca7995866b8c934a6aff3f4bcf54b813965b3205e8582853dbc3
- MD5 bd69268515eb385d3d853d3d52614fd3
- SHA1 b38d8bf9cbb31f5969653ffa9d4024a14b4d3f33
- SHA512 1b90863fa698e4d6d4cd312f71056c6629e34ae708ae55c411bd9ea4c61aeca42b708f771c078cff4cf9673539e89851fa009afc9cd11eb62077b7ed817b0c4f
- TLSH T11521E79767820EACACBF7BF145100272338AA1738918213A483D5DBF8EE020580582D0
- MD5 SHA1 SHA512 TLSH
- Path F:\ReadMe.txt
- Size 30B
- SHA256 fbdcb679ad47733eb13a9948050ffec19d3dfd399f03b838d40b739ac07993b9
- MD5 1d61ef6be33fd47745e7a2344a204866
- SHA1 0e7f24e3f55e040012a2ef4cde2889af7127171a
- SHA512 cf87370845afd590ce5076d5d052c66c4cf8ca1fb6188bd5ec80b359077e40a3ab70663495b7953a2cf95ef5c912a013474d8569a3d4fdb852b065e5533cf59f
- MD5 SHA1 SHA512