Analysis
- max time kernel
150s - max time network
105s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2026, 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe
- Size 191KB
- Sample260511-rdgbfafs9n
- SHA256 0c53bcac31caafca58f6e4d50ca851544e265772bad88db753c6e5904897709b
- MD5 d10609bcf7582cb5b6f5b7179fbcac79
- SHA1 614ec60938f7654249af0283b2b572d722833fd7
- SHA512 ec361ea68c4d3fe90ffb55a60090c6075288b60d4e3ef67605bde18a1540360cdf11d3863c3ffcbc92e7483c9de7fab5ac4b01a829dfd78ffd0a6945edc01275
- SSDEEP 3072:Q4dPQ4afbQz3Tcfec+/WXTe6mUKU2PcOq6s+IpCHNj2UNIqkZqomCP1L:ZFQ4afbQz3TOe6my2PcOq6KpCHNNcZqA
- TLSH T104146B21B6C1D473D05505B04FAFE6B65839FFA04E49491B73F03F2EAE752A0692B18B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\efsui.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\curl.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\grpconv.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\replace.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\write.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\psr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\MicrosoftEdgeUpdateSetup.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_proxy.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\JoinRename.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmproxyd.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\f\msinfo32.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpinit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\CustomInstallExec.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandboxClient.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\splwow64.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.22000.1_none_8b2e2daadb612558\dllhost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\r\pcaui.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\SyncAppvPublishingServer.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandbox.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\f\SearchApp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\hvix64.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\r\CustomInstallExec.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\f\wscript.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\r\appidtel.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\f\ApplySettingsTemplateCatalog.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmproxyd.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.376_none_836023902a7c3e20\bcdedit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\ldp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\f\winlogon.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.22000.1_none_8349effc86e8dd0a\hvc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.22000.1_none_08d1b85790fd9380\attrib.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\TextInputHost.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\r\AddSuggestedFoldersToLibraryDialog.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\audiodg.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.22000.1_none_a3552ea811351f6e\bitsadmin.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.22000.1_none_4b3b75ad087c3772\eventvwr.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\LaunchTM.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.318_none_5cc755143bc62566\f\ApplyTrustOffline.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.22000.1_none_a3552ea811351f6e\bitsadmin.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\f\LogonUI.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\LaunchTM.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\f\ldp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\f\wpnpinst.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\r\LogonUI.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\appidtel.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.51_none_35df5a459d516a9e\omadmclient.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.22000.1_none_3277593d92fa7a4c\imecfmui.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2300 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe 2300 2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_d10609bcf7582cb5b6f5b7179fbcac79_amadey_darkgate_elex_gcleaner_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2300