Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe
- Size 189KB
- Sample260511-vmncwsft8t
- SHA256 b003f0fdb37793e2707c256dc089583f55a13c85c4983cff85aee803e29ae236
- MD5 e8e2c7fac1afa59aa83f0c550c9a6ba6
- SHA1 78a8de097f6970cf145e592731127a962e9ee073
- SHA512 c7752da867ac8be3e59cc293ab27c48c6e720c6c72ac94400a2086f3daecdbb345bd1161d574e00580fa50e72527cf2f642aa678822c4b5da1ccf87bff672939
- SSDEEP 3072:K4dPQ4afbQz3Tcfec+/WXTe6mUKU2PcOq6s+IpCHNj2UNIqebvbCaNpdnphu:TFQ4afbQz3TOe6my2PcOq6KpCHNN2aaM
- TLSH T1F3147E36B6C0C477E1920AB01DFEA575547DBF601E228D5BA3E02E1DAE743E0690729F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\print.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\label.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\fc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\whoami.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\lodctr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RdpSa.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\net1.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\printui.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\provlaunch.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\sethc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Video.UI.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Video.UI.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_83943f096879c6b9\MigRegDB.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.22000.1_none_6de3b97f02b362b7\aspnet_compiler.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.22000.37_none_880eed7a42b2415b\f\hnsdiag.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmdiag.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\f\ksetup.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.22000.434_none_8c92a0565e9eec19\f\bootmgr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.22000.1_none_e84b398796060bdb\CloudNotifications.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\r\WerFault.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\r\windeploy.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_28babea403fb06cb\f\CallingShellApp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\r\AppVStreamingUX.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\r\AddSuggestedFoldersToLibraryDialog.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\r\ApplySettingsTemplateCatalog.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.22000.1_none_0812eff10a63b4d2\diskusage.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\f\LogonUI.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\f\klist.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_9f38aa7663fcbf45\f\control.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15806.0_none_646e7391043b0073\aspnet_regbrowsers.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.22000.37_none_880eed7a42b2415b\f\hnsdiag.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\r\audiodg.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.22000.1_none_95dccdc9d43c7f46\dsdbutil.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.22000.1_none_6f06193e8c8d8938\chkntfs.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\f\WUDFHost.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.493_none_7f8453c6e0afd8f5\f\nvspinfo.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.22000.1_none_f1914deb6513ab32\coredpussvr.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\f\dtdump.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\f\DiagnosticsHub.StandardCollector.Service.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.22000.1_none_1dbf6d61cb1e8d8c\Defrag.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\r\eshell.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\msra.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\f\SystemSettingsBroker.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\f\GenValObj.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\iexplore.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.22000.51_none_47d05adb57cc60db\UserDataSource.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\f\winresume.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.22000.1_none_5038d870ba5b9cc5\compact.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.22000.1_none_af27817de8dec1bc\csrss.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.22000.120_none_3da444c93fbedacf\f\OOBENetworkCaptivePortal.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_6e6aca3ab1161ee5\f\pcaui.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15806.0_none_468f0244bfc28b69\ComSvcConfig.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\winresume.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandbox.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.22000.1_none_75c3533c7b92f5af\RemotePosWorker.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\r\vmcompute.exe 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3400 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe 3400 2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_e8e2c7fac1afa59aa83f0c550c9a6ba6_amadey_darkgate_elex_gcleaner_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3400