Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
- Size 253KB
- Sample260417-tfx33scs2k
- SHA256 7be97bc57ab65a516014c920c8a05d325b684618b75fc3c630207191fab32c22
- MD5 9d5f10d6bc0097c3d739529412a8ebb9
- SHA1 62cf74cfb5442e9c7f474084bdc44d13010853b9
- SHA512 da7e5b8a84b91db12ae7910e424ea2d3830c1e48abdcfa1e507a532dc952493211ec94392d6171a21a7673080f4c025ac3e0f61e75e1cc16c53fd26859503c29
- SSDEEP 6144:NFQ4afbQz3TOe6my2PcOq6KpCHNNjKJcfh2m71ZJVC9Wj:NW4m8nttp71ZuK
- TLSH T1F144AE32F6D0C076F1A20AB45EBE9571643FBE111A264D1F63E43E0D9E743E0A91636B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mavinject.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\where.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\write.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\setup16.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Utilman.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\curl.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\systray.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ttdinject.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\ApplyTrustOffline.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\winresume.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\ApplySettingsTemplateCatalog.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\directxdatabaseupdater.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\f\winload.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\hnsdiag.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvix64.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\r\vmms.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\r\conhost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_5dccefa0bb5ef60b\clip.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\f\nvspinfo.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\f\LockScreenContentServer.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1_none_638e20742b3c9c9a\SpeechRuntime.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\uwfmgr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\psr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\f\Taskmgr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAppMonitor.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_e51212a36c631d23\CasPol.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\r\bfsvc.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\AppVClient.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winresume.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\f\RemoteAppLifetimeManager.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVNice.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\r\Taskmgr.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\FaceFodUninstaller.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVDllSurrogate.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\f\mavinject.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.19041.1_none_76edadec5ba257b3\verifier.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\SyncAppvPublishingServer.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\SpatialAudioLicenseSrv.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\r\EDPCleanup.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\f\pcalua.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\Microsoft.AsyncTextService.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1_none_339537d6c993f72b\AgentService.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\vmcompute.exe 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4220 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe 4220 2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4220