Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/03/2026, 01:53
Behavioral task
behavioral1
Sample
2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
- Size 178KB
- Sample260316-cbb7daax3s
- SHA256 d743728c1492063525534e1c67fc15e8bf241928f87cd64a509db8cb62955abe
- MD5 b8ed176f902dbd005d7b663961d1c04b
- SHA1 5aaa22343fb6b0399878c94883246e1846b5da32
- SHA512 882f3ea5d06fe3b995958b3b4f8a73c087cb8af5b1c2f2f89e0e9a073d42adda4585093838946c026f75846114141e0ab6fa59b251f69b240ee8b8f21ba3b032
- SSDEEP 3072:4jtpykdQOeDkhqikutBYYuoIqjAmGkXNmLxGF/tJr9t/fhKJ2ihFcuG:IpH2rEg6Sk9m6tVnEP0
- TLSH T17A047D05A7B2D0BAE477043865E99FF5CE2C39350B0148EB6788177969349E2E139F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7766) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 17 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Z: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\A: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\E: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\I: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\L: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\M: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\S: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\U: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\V: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\B: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\H: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\K: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\O: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Y: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\G: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\J: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\T: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\W: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\N: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\P: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Q: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\R: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-100_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-48.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-60_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\LargeTile.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\StoreLogo.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\NinjaCatOnDragon.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\SetupTeardown.ps1 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\DemoNotebook.onepkg 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\commerce\call_failure_illustration.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\nub.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\FlatFreehand3D.mp4 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-30_altform-unplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\es-es\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcor.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-32_altform-unplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-125.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\RangeSelector.xbf 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-150.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-high.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-125.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-125.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-unplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.ps1 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-48.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4504
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1609746302-1884177235-1125644204-1000\desktop.ini
- Size 1KB
- SHA256 c9eb46612351673f1323837e2dd80eecc5b1ebc1c5b4804feb214417466998fe
- MD5 2ff21cfac2f0a18b8e98b46a51dd9477
- SHA1 d7d1eda59875e4be0e2f562a127c05e52d37db06
- SHA512 6acf8fd128c40edbd82889c3b741dac48ede36aeba556b25a3791a5184a189e583df9e8bc207a08db3910cf51337a1bc42fc351fbfbfedbe06dc18d6683bde62
- TLSH T1EB21B72E9D06988CD263AC320479148B09916DAA6D8BB380713C7073E7CEF9631D968E
- MD5 SHA1 SHA512 TLSH
- Path C:\ReadMe.txt
- Size 28B
- SHA256 9c2f05d4e7e2bc4ab9decafd3acb2b473d51e9b26460e3d7494141cee264b3ad
- MD5 831e69e3e07b558074358adfdce44ab2
- SHA1 fdd8607c0191c9d6a19545ad9920d8d242170d22
- SHA512 8a9de7e1ecb5582e28ae2d9fda5435440994b602f71e59fe3e25e244d86355c5ce4db087c2703244f1a780f65ff83d75c9cd086999c348760b04352368872798
- MD5 SHA1 SHA512