Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe
- Size 744KB
- Sample260423-tpps3aaw4x
- SHA256 eb59de74ed1832aa2a6fd5bf3559b50973582a8a5494713576ab901b6a8fa6ea
- MD5 8d6cec2dff57f54bbd63511c4e2ca45c
- SHA1 5ab7450c91b0b4ba5c5535130a5290b6c0b884ff
- SHA512 6314c4066dc309e71490fd2c790c471a07e61d5ed274c6ba7b6ab6df577851a081cd114cba340e469295a16fc26059b1b062b4e0b119c3b0b0a8671057a869df
- SSDEEP 12288:XW4m8ntiGruf026ZlmR70Y/k9VS+LPMRm8:m4mWHuf0XoxUS+LkT
- TLSH T130F43A3639F8C637E2D245308E6CAAA0B0BDB9584E23CC5733D42E1C7B759D2A31665D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mavinject.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\msiexec.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\print.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\where.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\xwizard.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cscript.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\find.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{45F8B51D-EABC-42F1-BB45-74C2DEEAB111}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\aitstatic.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\Taskmgr.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\audiodg.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\autochk.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.19041.1_none_697599f55de29ec6\cttune.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\CapturePicker.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\f\DismHost.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.19041.1_none_89e9f21ed63037f6\ADSchemaAnalyzer.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\r\vmcompute.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\cleanmgr.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\r\directxdatabaseupdater.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAppMonitor.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\VmComputeAgent.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\f\hnsdiag.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\r\CloudExperienceHostBroker.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\r\pcaui.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\r\WindowsSandbox.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.19041.1_none_7957f8902b2072a6\choice.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\r\autochk.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\r\CompatTelRunner.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\control.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\r\adamsync.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\r\CameraBarcodeScannerPreview.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\securekernel.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.19041.1_none_bc67af2f62a6f130\ComputerDefaults.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\f\cttunesvr.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\f\DiagnosticsHub.StandardCollector.Service.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\dxgiadaptercache.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\VmComputeAgent.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\ScriptRunner.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\r\FaceFodUninstaller.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.SyncController.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\ApplyTrustOffline.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\r\SndVol.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_40fdd440b9ba0fea\cmd.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\r\ChtIME.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4100 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe 4100 2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_8d6cec2dff57f54bbd63511c4e2ca45c_darkgate_elex_gcleaner_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4100