Analysis
- max time kernel
139s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/03/2026, 01:53
Behavioral task
behavioral1
Sample
2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
- Size 178KB
- Sample260316-cbb7daax3s
- SHA256 d743728c1492063525534e1c67fc15e8bf241928f87cd64a509db8cb62955abe
- MD5 b8ed176f902dbd005d7b663961d1c04b
- SHA1 5aaa22343fb6b0399878c94883246e1846b5da32
- SHA512 882f3ea5d06fe3b995958b3b4f8a73c087cb8af5b1c2f2f89e0e9a073d42adda4585093838946c026f75846114141e0ab6fa59b251f69b240ee8b8f21ba3b032
- SSDEEP 3072:4jtpykdQOeDkhqikutBYYuoIqjAmGkXNmLxGF/tJr9t/fhKJ2ihFcuG:IpH2rEg6Sk9m6tVnEP0
- TLSH T17A047D05A7B2D0BAE477043865E99FF5CE2C39350B0148EB6788177969349E2E139F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- PLAY Ransomware, PlayCrypt
Ransomware family first seen in mid 2022.
- Play family
- Renames multiple (7820) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 28 IoCs
description ioc Process File opened for modification C:\Users\Public\Desktop\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Music\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\M: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\N: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\P: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Q: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\R: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\S: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\U: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\A: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\E: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\H: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\J: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\K: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\W: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\X: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Y: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\G: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\T: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\Z: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\B: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\L: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\O: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened (read-only) \??\V: 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.ELM 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\msader15.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\TipsSmallTile.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sl_get.svg 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-64.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-72_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\ColorPicker.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nb_NEUTER.pak.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\ISize.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sqlpdw.xsl.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Toggle.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\SearchEmail2x.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsSmallTile.scale-100.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-125.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\NotepadAppList.scale-100.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-30_altform-unplated_contrast-black.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_contrast-white.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSSOAP30.DLL.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-20_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-400.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ODATACPP.DLL.PLAY 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreSmallTile.scale-200_altform-colorful_theme-light.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\LargeTile.scale-200.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-60_altform-lightunplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\WinMetadata\Microsoft.UI.Xaml.winmd 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\compat\index.js 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\mpvis.dll.mui 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-48_altform-unplated.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-400.png 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-16_b8ed176f902dbd005d7b663961d1c04b_amadey_elex_play.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1632
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3847269522-1618051987-1942096715-1000\desktop.ini
- Size 1KB
- SHA256 8aaa60bcad2d8adff02ff3bc05718ed6ce800a7b315318667cd763fa473018b2
- MD5 6f81d2f369bed7134da642c74ced478f
- SHA1 89049ed331d7a34932d3079c452b04034dc4bd0d
- SHA512 4deada5bd2ceb6ff61768cd2352bbddd8cd5e51f639345e41da8cf8ca01ce6266f073b2c1a29e239a6f2a0c34930e2e373f17f6ac045e894b393271b10942ab2
- TLSH T15C21B70F3A13E70597D3E32081B78056888B0894D6477D45B37580FE80C2278FB26493
- MD5 SHA1 SHA512 TLSH
- Path C:\ReadMe.txt
- Size 28B
- SHA256 9c2f05d4e7e2bc4ab9decafd3acb2b473d51e9b26460e3d7494141cee264b3ad
- MD5 831e69e3e07b558074358adfdce44ab2
- SHA1 fdd8607c0191c9d6a19545ad9920d8d242170d22
- SHA512 8a9de7e1ecb5582e28ae2d9fda5435440994b602f71e59fe3e25e244d86355c5ce4db087c2703244f1a780f65ff83d75c9cd086999c348760b04352368872798
- MD5 SHA1 SHA512