File name:

2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry

Full analysis: https://app.any.run/tasks/12f7db18-e408-4366-87c4-98d144fa3068
Verdict: Malicious activity
Threats:

BlackMatter is a ransomware strain operating as a Ransomware-as-a-Service (RaaS), designed to encrypt files, remove recovery options, and extort victims across critical industries. Emerging in 2021, it quickly became a major concern due to its ability to evade defenses, spread across networks, and cause large-scale operational disruption, forcing security teams to act against a highly destructive and persistent threat.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 22:02:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmatter
ransomware
auto-sch
uac
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

65538E16F1090CFC81C5465A2185FA41

SHA1:

C8C738B726021638C298ED5E93BF720CBBF03399

SHA256:

82AF319F72C145EC6FF713C64F13307C2A7C098B534F15D59AD0636A1455DD1F

SSDEEP:

1536:l1FO8q31rzaGSX/GrfIjQgP111BoLfiYmZx5AG8Sf9YMXiQeJn:l1FO8q31rzaGSvMqWSf9YMXiZJn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMATTER mutex has been found

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 1080)

    • Uses Task Scheduler to autorun other applications

      • svchost.exe (PID: 1080)

    • Deletes shadow copies

      • svchost.exe (PID: 1080)
      • cmd.exe (PID: 6348)
      • cmd.exe (PID: 4816)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 5620)
      • svchost.exe (PID: 1080)

    • Bypass User Account Control (Modify registry)

      • svchost.exe (PID: 1080)

    • Starts NET.EXE for service management

      • net.exe (PID: 4544)
      • net.exe (PID: 6356)
      • net.exe (PID: 4104)
      • svchost.exe (PID: 1080)
      • net.exe (PID: 4808)
      • net.exe (PID: 4860)
      • net.exe (PID: 6336)
      • net.exe (PID: 6960)
      • net.exe (PID: 1568)
      • net.exe (PID: 5644)
      • net.exe (PID: 2192)
      • net.exe (PID: 6428)
      • net.exe (PID: 7056)
      • net.exe (PID: 4708)
      • net.exe (PID: 5644)
      • net.exe (PID: 5172)
      • net.exe (PID: 3800)
      • net.exe (PID: 3924)
      • net.exe (PID: 7080)
      • net.exe (PID: 7020)
      • net.exe (PID: 4760)
      • net.exe (PID: 1484)
      • net.exe (PID: 6104)
      • net.exe (PID: 4764)
      • net.exe (PID: 2596)
      • net.exe (PID: 1964)
      • net.exe (PID: 4456)
      • net.exe (PID: 6488)
      • net.exe (PID: 1812)
      • net.exe (PID: 7040)
      • net.exe (PID: 6236)
      • net.exe (PID: 4188)
      • net.exe (PID: 6620)
      • net.exe (PID: 5644)
      • net.exe (PID: 1212)
      • net.exe (PID: 6348)
      • net.exe (PID: 6620)
      • net.exe (PID: 1644)
      • net.exe (PID: 6348)
      • net.exe (PID: 5764)
      • net.exe (PID: 6488)
      • net.exe (PID: 6680)
      • net.exe (PID: 6980)
      • net.exe (PID: 4188)
      • net.exe (PID: 5252)
      • net.exe (PID: 1896)
      • net.exe (PID: 1816)
      • net.exe (PID: 2460)
      • net.exe (PID: 6292)
      • net.exe (PID: 2124)
      • net.exe (PID: 2368)
      • net.exe (PID: 4800)
      • net.exe (PID: 3668)
      • net.exe (PID: 1896)
      • net.exe (PID: 4412)
      • net.exe (PID: 3668)
      • net.exe (PID: 4960)
      • net.exe (PID: 768)
      • net.exe (PID: 984)
      • net.exe (PID: 5020)
      • net.exe (PID: 1204)
      • net.exe (PID: 3652)
      • net.exe (PID: 3788)
      • net.exe (PID: 2512)
      • net.exe (PID: 6140)
      • net.exe (PID: 5008)
      • net.exe (PID: 6152)
      • net.exe (PID: 6892)
      • net.exe (PID: 3620)
      • net.exe (PID: 1132)
      • net.exe (PID: 2604)
      • net.exe (PID: 1512)
      • net.exe (PID: 756)
      • net.exe (PID: 5552)
      • net.exe (PID: 6756)
      • net.exe (PID: 1200)
      • net.exe (PID: 2276)
      • net.exe (PID: 6400)
      • net.exe (PID: 6656)
      • net.exe (PID: 1440)
      • net.exe (PID: 4828)
      • net.exe (PID: 2836)
      • net.exe (PID: 3388)
      • net.exe (PID: 2760)
      • net.exe (PID: 6980)
      • net.exe (PID: 4528)
      • net.exe (PID: 2664)
      • net.exe (PID: 6320)
      • net.exe (PID: 6704)
      • net.exe (PID: 5600)
      • net.exe (PID: 4380)
      • net.exe (PID: 2228)
      • net.exe (PID: 6472)
      • net.exe (PID: 7048)
      • net.exe (PID: 1560)
      • net.exe (PID: 5552)
      • net.exe (PID: 1096)
      • net.exe (PID: 6680)
      • net.exe (PID: 6336)
      • net.exe (PID: 1096)
      • net.exe (PID: 6012)
      • net.exe (PID: 6836)
      • net.exe (PID: 6388)
      • net.exe (PID: 4576)
      • net.exe (PID: 4312)
      • net.exe (PID: 6652)
      • net.exe (PID: 3112)
      • net.exe (PID: 5252)
      • net.exe (PID: 1508)
      • net.exe (PID: 1096)
      • net.exe (PID: 6380)
      • net.exe (PID: 1880)
      • net.exe (PID: 5116)
      • net.exe (PID: 5824)
      • net.exe (PID: 4040)
      • net.exe (PID: 4680)
      • net.exe (PID: 3732)
      • net.exe (PID: 7072)
      • net.exe (PID: 3644)
      • net.exe (PID: 1880)
      • net.exe (PID: 5552)
      • net.exe (PID: 4040)
      • net.exe (PID: 3780)
      • net.exe (PID: 2632)
      • net.exe (PID: 5716)
      • net.exe (PID: 3884)
      • net.exe (PID: 6956)
      • net.exe (PID: 6420)
      • net.exe (PID: 4828)
      • net.exe (PID: 6336)
      • net.exe (PID: 3788)
      • net.exe (PID: 3752)
      • net.exe (PID: 6472)
      • net.exe (PID: 4324)
      • net.exe (PID: 3752)
      • net.exe (PID: 2760)
      • net.exe (PID: 4324)
      • net.exe (PID: 6472)
      • net.exe (PID: 4560)

    • Starts NET.EXE to view/change shared resources

      • net.exe (PID: 1512)
      • svchost.exe (PID: 1080)

    • Changes powershell execution policy (Bypass)

      • svchost.exe (PID: 1080)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6256)
      • powershell.exe (PID: 6104)

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 1080)

    • Starts SC.EXE for service management

      • svchost.exe (PID: 1080)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 2492)

  • SUSPICIOUS

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7048)
      • cmd.exe (PID: 2492)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 4664)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 3620)
      • cmd.exe (PID: 6224)
      • cmd.exe (PID: 4808)
      • cmd.exe (PID: 420)
      • cmd.exe (PID: 6676)

    • Executable content was dropped or overwritten

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)

    • Executing commands from a ".bat" file

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)

    • Reads the date of Windows installation

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)

    • Reads security settings of Internet Explorer

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)

    • Starts itself from another location

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)

    • The process creates files with name similar to system file names

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)
      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)

    • Changes default file association

      • svchost.exe (PID: 1080)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1200)
      • sc.exe (PID: 760)
      • sc.exe (PID: 856)
      • sc.exe (PID: 1508)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 420)
      • sc.exe (PID: 3624)
      • sc.exe (PID: 6368)
      • sc.exe (PID: 4648)
      • sc.exe (PID: 3572)
      • sc.exe (PID: 3520)
      • sc.exe (PID: 6016)
      • sc.exe (PID: 6504)
      • sc.exe (PID: 3480)
      • sc.exe (PID: 4892)
      • sc.exe (PID: 3672)
      • sc.exe (PID: 3564)
      • sc.exe (PID: 4236)
      • sc.exe (PID: 6896)
      • sc.exe (PID: 3788)
      • sc.exe (PID: 1560)
      • sc.exe (PID: 1496)
      • sc.exe (PID: 6128)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 4816)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 1984)
      • sc.exe (PID: 1568)
      • sc.exe (PID: 5552)
      • sc.exe (PID: 3956)
      • sc.exe (PID: 1380)
      • sc.exe (PID: 1328)
      • sc.exe (PID: 5184)
      • sc.exe (PID: 2212)
      • sc.exe (PID: 2632)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 1136)
      • sc.exe (PID: 5808)
      • sc.exe (PID: 6124)
      • sc.exe (PID: 3588)
      • sc.exe (PID: 2280)
      • sc.exe (PID: 4012)
      • sc.exe (PID: 6336)
      • sc.exe (PID: 6400)
      • sc.exe (PID: 3504)
      • sc.exe (PID: 1028)
      • sc.exe (PID: 3948)
      • sc.exe (PID: 1336)
      • sc.exe (PID: 5564)
      • sc.exe (PID: 5168)
      • sc.exe (PID: 6472)
      • sc.exe (PID: 3768)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 984)
      • sc.exe (PID: 7104)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 2760)
      • sc.exe (PID: 6256)
      • sc.exe (PID: 5600)
      • sc.exe (PID: 5692)
      • sc.exe (PID: 1700)
      • sc.exe (PID: 864)
      • sc.exe (PID: 4768)
      • sc.exe (PID: 3652)
      • sc.exe (PID: 5824)
      • sc.exe (PID: 6612)
      • sc.exe (PID: 5928)
      • sc.exe (PID: 5012)
      • sc.exe (PID: 5372)
      • sc.exe (PID: 4680)
      • sc.exe (PID: 3556)
      • sc.exe (PID: 3780)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 2120)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 6160)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 5124)
      • sc.exe (PID: 3884)
      • sc.exe (PID: 6304)
      • sc.exe (PID: 2520)
      • sc.exe (PID: 6488)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 4412)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 5140)
      • sc.exe (PID: 6380)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 3092)
      • sc.exe (PID: 4764)
      • sc.exe (PID: 6840)
      • sc.exe (PID: 1484)
      • sc.exe (PID: 4188)
      • sc.exe (PID: 6292)
      • sc.exe (PID: 6672)
      • sc.exe (PID: 4312)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 4760)
      • sc.exe (PID: 3740)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 1728)
      • sc.exe (PID: 6356)
      • sc.exe (PID: 4864)
      • sc.exe (PID: 4156)
      • sc.exe (PID: 1352)
      • sc.exe (PID: 2596)
      • sc.exe (PID: 4172)
      • sc.exe (PID: 3480)
      • sc.exe (PID: 3976)
      • sc.exe (PID: 6140)
      • sc.exe (PID: 6868)
      • sc.exe (PID: 6164)
      • sc.exe (PID: 4892)
      • sc.exe (PID: 3980)
      • sc.exe (PID: 7020)
      • sc.exe (PID: 2468)
      • sc.exe (PID: 4760)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 1700)
      • sc.exe (PID: 5124)
      • sc.exe (PID: 3556)
      • sc.exe (PID: 1028)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 6636)
      • sc.exe (PID: 5476)
      • sc.exe (PID: 5952)
      • sc.exe (PID: 5020)
      • sc.exe (PID: 1760)
      • sc.exe (PID: 6748)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 1728)
      • sc.exe (PID: 3520)
      • sc.exe (PID: 3504)
      • sc.exe (PID: 7060)
      • sc.exe (PID: 768)
      • sc.exe (PID: 6428)
      • sc.exe (PID: 6292)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 1812)
      • sc.exe (PID: 3460)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 5184)
      • sc.exe (PID: 3092)
      • sc.exe (PID: 1484)
      • sc.exe (PID: 2520)
      • sc.exe (PID: 2864)
      • sc.exe (PID: 3148)
      • sc.exe (PID: 4816)
      • sc.exe (PID: 2124)
      • sc.exe (PID: 2192)
      • sc.exe (PID: 6936)
      • sc.exe (PID: 4412)
      • sc.exe (PID: 6128)
      • sc.exe (PID: 5168)
      • sc.exe (PID: 1336)
      • sc.exe (PID: 4020)
      • sc.exe (PID: 1380)
      • sc.exe (PID: 4120)
      • sc.exe (PID: 1488)
      • sc.exe (PID: 6216)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 5368)
      • sc.exe (PID: 3108)
      • sc.exe (PID: 480)
      • sc.exe (PID: 5876)
      • sc.exe (PID: 7128)
      • sc.exe (PID: 432)
      • sc.exe (PID: 5808)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 7132)
      • sc.exe (PID: 5616)
      • sc.exe (PID: 4860)
      • sc.exe (PID: 6520)
      • sc.exe (PID: 1688)
      • sc.exe (PID: 2668)
      • sc.exe (PID: 1200)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 4836)
      • sc.exe (PID: 3948)
      • sc.exe (PID: 2764)
      • sc.exe (PID: 6364)
      • sc.exe (PID: 6124)
      • sc.exe (PID: 3564)
      • sc.exe (PID: 4088)
      • sc.exe (PID: 1520)
      • sc.exe (PID: 3720)
      • sc.exe (PID: 1564)
      • sc.exe (PID: 4832)
      • sc.exe (PID: 6980)
      • sc.exe (PID: 4676)
      • sc.exe (PID: 6512)
      • sc.exe (PID: 6320)
      • sc.exe (PID: 2728)
      • sc.exe (PID: 888)
      • sc.exe (PID: 2276)
      • sc.exe (PID: 6264)
      • sc.exe (PID: 2972)
      • sc.exe (PID: 5564)
      • sc.exe (PID: 1496)
      • sc.exe (PID: 5628)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 2464)
      • sc.exe (PID: 6656)
      • sc.exe (PID: 6012)
      • sc.exe (PID: 7156)
      • sc.exe (PID: 5652)
      • sc.exe (PID: 2040)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 5768)
      • sc.exe (PID: 6232)
      • sc.exe (PID: 7080)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 7040)
      • sc.exe (PID: 6152)
      • sc.exe (PID: 1964)
      • sc.exe (PID: 3196)
      • sc.exe (PID: 4528)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 5692)
      • sc.exe (PID: 6400)
      • sc.exe (PID: 4048)
      • sc.exe (PID: 1192)
      • sc.exe (PID: 1508)
      • sc.exe (PID: 3388)
      • sc.exe (PID: 6164)
      • sc.exe (PID: 2836)
      • sc.exe (PID: 5532)
      • sc.exe (PID: 7120)
      • sc.exe (PID: 864)
      • sc.exe (PID: 4960)
      • sc.exe (PID: 5468)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 6380)
      • sc.exe (PID: 756)
      • sc.exe (PID: 5744)
      • sc.exe (PID: 1180)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 1816)
      • sc.exe (PID: 4796)
      • sc.exe (PID: 4052)
      • sc.exe (PID: 6376)
      • sc.exe (PID: 3048)
      • sc.exe (PID: 2800)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 3924)
      • sc.exe (PID: 6832)
      • sc.exe (PID: 2664)
      • sc.exe (PID: 3788)
      • sc.exe (PID: 5008)
      • sc.exe (PID: 2512)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 3740)
      • sc.exe (PID: 7104)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 2604)
      • sc.exe (PID: 760)
      • sc.exe (PID: 304)
      • sc.exe (PID: 5060)
      • sc.exe (PID: 6192)
      • sc.exe (PID: 3944)
      • sc.exe (PID: 3780)
      • sc.exe (PID: 5716)
      • sc.exe (PID: 4196)
      • sc.exe (PID: 1388)
      • sc.exe (PID: 5928)
      • sc.exe (PID: 1868)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 5172)
      • sc.exe (PID: 6368)
      • sc.exe (PID: 4104)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 4236)
      • sc.exe (PID: 5032)
      • sc.exe (PID: 4112)
      • sc.exe (PID: 7164)
      • sc.exe (PID: 6200)
      • sc.exe (PID: 3960)
      • sc.exe (PID: 5288)
      • sc.exe (PID: 4680)
      • sc.exe (PID: 436)
      • sc.exe (PID: 7052)
      • sc.exe (PID: 724)
      • sc.exe (PID: 4944)

    • Starts SC.EXE for service management

      • svchost.exe (PID: 1080)

    • Starts NET.EXE for network exploration

      • svchost.exe (PID: 1080)

    • Starts POWERSHELL.EXE for commands execution

      • svchost.exe (PID: 1080)

    • The process executes Powershell scripts

      • svchost.exe (PID: 1080)

    • Stops a currently running service

      • sc.exe (PID: 4444)
      • sc.exe (PID: 1872)
      • sc.exe (PID: 2076)
      • sc.exe (PID: 2148)
      • sc.exe (PID: 1644)

  • INFO

    • Reads the machine GUID from the registry

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)

    • Reads the computer name

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)

    • Create files in a temporary directory

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)

    • Checks supported languages

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)
      • svchost.exe (PID: 5744)

    • Process checks computer location settings

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)
      • svchost.exe (PID: 1080)

    • Creates files or folders in the user directory

      • 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe (PID: 1604)

    • Launching a file from a Registry key

      • svchost.exe (PID: 1080)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5764)
      • notepad.exe (PID: 6220)
      • WMIC.exe (PID: 3676)

    • Manual execution by a user

      • svchost.exe (PID: 5744)
      • rundll32.exe (PID: 3488)
      • notepad.exe (PID: 6220)
      • rundll32.exe (PID: 3876)
      • rundll32.exe (PID: 4804)
      • powershell.exe (PID: 6104)

    • Reads the software policy settings

      • slui.exe (PID: 3844)

    • Checks proxy server information

      • slui.exe (PID: 3844)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6256)
      • powershell.exe (PID: 6104)

    • Launching a file from Task Scheduler

      • svchost.exe (PID: 1080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:19 18:26:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 74240
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1413e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: LB3.exe
LegalCopyright:
OriginalFileName: LB3.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
1 210
Monitored processes
1 077
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs svchost.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs timeout.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe fodhelper.exe no specs svchost.exe no specs fodhelper.exe no specs wbadmin.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs rundll32.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs notepad.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs rundll32.exe no specs rundll32.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs rundll32.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs slui.exe net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs vssadmin.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs bcdedit.exe no specs conhost.exe no specs bcdedit.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs reagentc.exe no specs conhost.exe no specs wbadmin.exe conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\WINDOWS\system32\net1 stop VeeamTransportSvcC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
304"sc.exe" config MVArmor start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
316C:\WINDOWS\system32\net1 stop VeeamDeploymentServiceC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
320C:\WINDOWS\system32\net1 stop BackupExecRPCServiceC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\dsrole.dll
420"cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\selfdestruct_RPy5H6T7.bat"C:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
420"sc.exe" delete sqlC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 281
Read events
27 277
Write events
4
Delete events
0

Modification events

(PID) Process:(1080) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Update5YoOau
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(1080) svchost.exeKey:HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command
Operation:writeName:DelegateExecute
Value:
(PID) Process:(1080) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:VNtFUQG9x
Value:
C:\Users\admin\AppData\Local\svchost.exe
Executable files
6
Suspicious files
67
Text files
29
Unknown types
0

Dropped files

PID
Process
Filename
Type
1080svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_fajtQ9Sy.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
16042025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_dfmp3yNa.battext
MD5:5BF575FE0A18AB8CC3F7057E6B992EF8
SHA256:35B34780DDCA0D6083F525572E74836685DAF253DA1192E7A1B5F00350D706AA
16042025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_JlDCIOpW.battext
MD5:5BF575FE0A18AB8CC3F7057E6B992EF8
SHA256:35B34780DDCA0D6083F525572E74836685DAF253DA1192E7A1B5F00350D706AA
5744svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_fcI8f0xf.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
5744svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_NUOlAQFz.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
16042025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_ABw71eWI.battext
MD5:5BF575FE0A18AB8CC3F7057E6B992EF8
SHA256:35B34780DDCA0D6083F525572E74836685DAF253DA1192E7A1B5F00350D706AA
1080svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_rHxJxp07.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
1080svchost.exeC:\Users\admin\AppData\Local\Temp\update_ffjfxo.exeexecutable
MD5:65538E16F1090CFC81C5465A2185FA41
SHA256:82AF319F72C145EC6FF713C64F13307C2A7C098B534F15D59AD0636A1455DD1F
1080svchost.exeC:\Users\admin\Desktop\UtQXmrPuz.rtf.VNtFUQG9xbinary
MD5:0B40C4C18BE65D0E98F96D17846B8C76
SHA256:F20F84C782CE23469692AAAE671C46467C569BDD19BD8D1F78675AB8C5A9B751
1080svchost.exeC:\Users\admin\Desktop\Y0DsDe1Fm.png.VNtFUQG9xbinary
MD5:F64075A9ACB7434C7D25408B2CFBA9FD
SHA256:C1A7C43C72D54EC7319DF35592F06180BC4741D056EDFED4A23169E8B300093A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5116
RUXIMICS.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5116
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5116
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5116
RUXIMICS.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 52.178.17.235
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_65538e16f1090cfc81c5465a2185fa41_destroyer_elex_wannacry