Analysis
- max time kernel
88s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/03/2026, 12:29
Behavioral task
behavioral1
Sample
2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe
- Size 178KB
- Sample260311-ppdctafs5w
- SHA256 79584350c7640da5be39661998e772d07aa1fdd02d504fa6ca7d7d8625df6973
- MD5 edf5d8724ce5a964b6c72ca9f7c3edf6
- SHA1 82cb37868625f1471b4ae9ea8877d0f009117672
- SHA512 b71b7f0dc44e8a91d9e8dc5bdc8186ea9aa3d3f11c43afb2394979ced13d2a3b8897873cc65a150cc67639c9e3d8a8bab8f9218164de99818c46a9dc85f2ef9f
- SSDEEP 3072:4jtpykdQOeDkhqikutBYYuoIqjAmGkXNmLxGF/tJr9t/fhKJ2ih5cuG:IpH2rEg6Sk9m6tVnEP4
- TLSH T1A9047D05A7B2D0BAE477043865E99FF5CE2C39350B0148EB6788177969349E2E139F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Program Files\desktop.ini 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1456842261-3464001825-2855069093-1000\desktop.ini 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\L: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\Q: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\V: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\W: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\X: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\H: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\J: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\U: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\Y: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\B: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\I: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\K: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\M: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\R: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\T: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\A: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\E: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\G: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\N: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\O: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\P: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened (read-only) \??\S: 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-200.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HandTracking.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-400_contrast-white.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintLargeTile.scale-125.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-64_altform-unplated.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Fabric.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Microsoft.Apps.People.BackgroundTasks.winmd 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\wwwroot\app.html 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSplashScreen.scale-125.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.scale-125.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-48_altform-lightunplated_contrast-black.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-150.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-20_altform-unplated.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24_altform-unplated.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\wmlaunch.exe.mui 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireAppList.targetsize-64_altform-unplated_contrast-white.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-48.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-32_altform-unplated_contrast-white.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-80.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jre-1.8\LICENSE 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\ui-strings.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\Graphing.targetsize-64_contrast-black.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-256_altform-lightunplated.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\test\setRenderSpy.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\New-Fixture.ps1 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-48_contrast-black.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-125.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-80.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\FillnSign_visual.svg 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nb_FEMININE.pak 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\fr-fr\Resources.resw 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256_altform-unplated.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-24_altform-lightunplated_contrast-white.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100_altform-colorful_theme-dark.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@fluentui\dom-utilities\lib-commonjs\IVirtualElement.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-400.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-100.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ui-strings.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\initials.js 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateAppIcon.altform-lightunplated_targetsize-48.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\FFmpegInterop.winmd 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-150.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons.png 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-11_edf5d8724ce5a964b6c72ca9f7c3edf6_amadey_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5004
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1456842261-3464001825-2855069093-1000\desktop.ini
- Size 1KB
- SHA256 0d6e33dcfcfafbaba31ed7c47929266bce3c3ffda5eae0635b65b0d0b7788717
- MD5 58ff8e77b7d96aa9454a37122bfbc3f3
- SHA1 7f7fba5cf3a581c19848bd12f8a910020a2fe34d
- SHA512 bc1a8b82a929c603e8b7fbf66407820a49e7540b08c6ddaa2540aa13b05132f64b4a36efe21b77d727cc9cff8e4991678e9374f801826e2d93ad256b610a686a
- TLSH T14021B7119C02005AD5A43C33ADB05B182F1A97FA442696A5703BC1FD7F45284E97A8E6
- MD5 SHA1 SHA512 TLSH
- Path C:\ReadMe.txt
- Size 28B
- SHA256 9c2f05d4e7e2bc4ab9decafd3acb2b473d51e9b26460e3d7494141cee264b3ad
- MD5 831e69e3e07b558074358adfdce44ab2
- SHA1 fdd8607c0191c9d6a19545ad9920d8d242170d22
- SHA512 8a9de7e1ecb5582e28ae2d9fda5435440994b602f71e59fe3e25e244d86355c5ce4db087c2703244f1a780f65ff83d75c9cd086999c348760b04352368872798
- MD5 SHA1 SHA512