Analysis
- max time kernel
149s - max time network
102s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
10/05/2026, 20:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe
- Size 253KB
- Sample260510-zleftaev4v
- SHA256 9292055ed58788cbbcc95bccc387639126525258e55419c8457a775eec036436
- MD5 db67810117fc52a81da86157ab0deb8f
- SHA1 47fbc3cf8f6572af98f08a8db26f790a2ae9b691
- SHA512 dcd17e6b50a8396e57cfcd1d1ce1aa66d559194c8f89d5c4d7b8ba2e1434b3da0937fbca016fabe541ed427507d1c827684c40b3b72a6a65971fd242b6ad17bd
- SSDEEP 6144:rFQ4afbQz3TOe6my2PcOq6KpCHNNDKJcfh2m71ZJVC9Fy:rW4m8ntxp71Zu4
- TLSH T11A44BE22F5C0C476E1A20AB45EBEE571643AFF205E20565F73E43F0E9D753A0A907267
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\logman.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\net1.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\charmap.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\where.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cipher.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\calc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\msra.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\subst.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\calc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\133.0.3065.69\MicrosoftEdge_X64_133.0.3065.69.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_proxy.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\identity_helper.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdateOnDemand.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_186109\java.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_186109\javaws.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\cookie_exporter.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\BHO\ie_to_edge_stub.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\r\vmcompute.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.493_none_7f8453c6e0afd8f5\nvspinfo.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.22000.120_none_a5bf55f88f23c8b5\f\FaceFodUninstaller.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\r\audiodg.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.22000.1_none_62d2023a9a53a0ea\bootsect.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\f\PkgMgr.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\cscript.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\f\CHXSmartScreen.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\f\CustomShellHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFault.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\curl.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.22000.348_none_e313cfb919daa6b1\f\securekernel.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_b9334c2faa2133a2\agentactivationruntimestarter.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\f\PktMon.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\sdchange.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.1_none_d4af4db521f3ebaf\curl.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\UevTemplateBaselineGenerator.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\f\AppResolverUX.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\LogonUI.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\LaunchTM.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.22000.120_none_fbcb84a27b36694e\f\BioEnrollmentHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\f\ApplySettingsTemplateCatalog.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\winresume.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\winload.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_518c740df132d17d\f\tar.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.22000.120_none_898d9e6ac325eeaf\f\AccountsControlHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\f\UsoClient.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchFilterHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.376_none_2a06005b3bb58976\r\appidtel.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\ApplySettingsTemplateCatalog.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\f\RMActivate_ssp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.282_none_3066e216e524ffb4\r\vmwp.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\f\AppVShNotify.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tpm-diagnostics_31bf3856ad364e35_10.0.22000.469_none_3fa2439425626f6e\f\TpmDiagnostics.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\nvspinfo.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\AppVShNotify.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\f\LogonUI.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.318_none_4b63ad41811cb76d\winload.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\WindowsSandbox.exe 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1684 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe 1684 2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_db67810117fc52a81da86157ab0deb8f_amadey_darkgate_elex_gcleaner_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1684