File name:

LB3.exe

Full analysis: https://app.any.run/tasks/efe238d8-0eee-4efa-b656-c045ab320589
Verdict: Malicious activity
Threats:

BlackMatter is a ransomware strain operating as a Ransomware-as-a-Service (RaaS), designed to encrypt files, remove recovery options, and extort victims across critical industries. Emerging in 2021, it quickly became a major concern due to its ability to evade defenses, spread across networks, and cause large-scale operational disruption, forcing security teams to act against a highly destructive and persistent threat.

Malware Trends Tracker     >>>
Analysis date: June 22, 2025, 15:38:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmatter
ransomware
uac
lockbit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

7E94169D448A160D8649BE4FDDF49116

SHA1:

3A21082BBFEFF900F8D8606EF11B5ED240B3AE61

SHA256:

42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90

SSDEEP:

768:X0nxIJAk4TLsPgri4OPRWiy/uK7xef8lyPr0vraQHMqb0VSlBuRWp80Nq99u8mpA:gj6tHmuZr+u+M+5ruG80A99uV4hN/3B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMATTER mutex has been found

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Bypass User Account Control (Modify registry)

      • svchost.exe (PID: 4892)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 4892)

    • Deletes shadow copies

      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 620)
      • svchost.exe (PID: 4892)
      • cmd.exe (PID: 6128)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2188)
      • cmd.exe (PID: 4684)

    • Starts NET.EXE for service management

      • svchost.exe (PID: 4892)
      • net.exe (PID: 3112)
      • net.exe (PID: 5232)
      • net.exe (PID: 432)
      • net.exe (PID: 4156)
      • net.exe (PID: 4160)
      • net.exe (PID: 5284)
      • net.exe (PID: 2864)
      • net.exe (PID: 3608)
      • net.exe (PID: 3196)
      • net.exe (PID: 236)
      • net.exe (PID: 5124)
      • net.exe (PID: 4760)
      • net.exe (PID: 4456)
      • net.exe (PID: 5708)
      • net.exe (PID: 1180)
      • net.exe (PID: 5124)
      • net.exe (PID: 4552)
      • net.exe (PID: 4040)
      • net.exe (PID: 3732)
      • net.exe (PID: 3480)
      • net.exe (PID: 3640)
      • net.exe (PID: 3936)
      • net.exe (PID: 3504)
      • net.exe (PID: 1560)
      • net.exe (PID: 6700)
      • net.exe (PID: 2668)
      • net.exe (PID: 3624)
      • net.exe (PID: 2348)
      • net.exe (PID: 3936)
      • net.exe (PID: 424)
      • net.exe (PID: 5496)
      • net.exe (PID: 3908)
      • net.exe (PID: 984)
      • net.exe (PID: 6348)
      • net.exe (PID: 1644)
      • net.exe (PID: 1896)
      • net.exe (PID: 1720)
      • net.exe (PID: 1644)
      • net.exe (PID: 4888)
      • net.exe (PID: 3028)
      • net.exe (PID: 7052)
      • net.exe (PID: 7104)
      • net.exe (PID: 1560)
      • net.exe (PID: 4456)
      • net.exe (PID: 5708)
      • net.exe (PID: 4460)
      • net.exe (PID: 1508)
      • net.exe (PID: 3584)
      • net.exe (PID: 6940)
      • net.exe (PID: 6772)
      • net.exe (PID: 4312)
      • net.exe (PID: 6216)
      • net.exe (PID: 1512)
      • net.exe (PID: 6160)
      • net.exe (PID: 5876)
      • net.exe (PID: 4156)
      • net.exe (PID: 6796)
      • net.exe (PID: 316)
      • net.exe (PID: 4544)
      • net.exe (PID: 5924)
      • net.exe (PID: 1752)
      • net.exe (PID: 4512)
      • net.exe (PID: 5716)
      • net.exe (PID: 6188)
      • net.exe (PID: 4888)
      • net.exe (PID: 3628)
      • net.exe (PID: 6148)
      • net.exe (PID: 6292)
      • net.exe (PID: 7060)
      • net.exe (PID: 1080)
      • net.exe (PID: 2632)
      • net.exe (PID: 4552)
      • net.exe (PID: 1324)
      • net.exe (PID: 3584)
      • net.exe (PID: 4664)
      • net.exe (PID: 2716)
      • net.exe (PID: 2448)
      • net.exe (PID: 1512)
      • net.exe (PID: 5248)
      • net.exe (PID: 5496)
      • net.exe (PID: 4040)
      • net.exe (PID: 1232)
      • net.exe (PID: 3100)
      • net.exe (PID: 984)
      • net.exe (PID: 6900)
      • net.exe (PID: 6636)
      • net.exe (PID: 5716)
      • net.exe (PID: 5248)
      • net.exe (PID: 6688)
      • net.exe (PID: 7092)
      • net.exe (PID: 3092)
      • net.exe (PID: 504)

    • [YARA] LockBit is detected

      • svchost.exe (PID: 4892)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Starts CMD.EXE for commands execution

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6852)
      • cmd.exe (PID: 1944)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 3788)
      • cmd.exe (PID: 3876)
      • cmd.exe (PID: 2276)
      • cmd.exe (PID: 6512)

    • Executable content was dropped or overwritten

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • The process creates files with name similar to system file names

      • LB3.exe (PID: 3780)

    • Reads security settings of Internet Explorer

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Reads the date of Windows installation

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Changes default file association

      • svchost.exe (PID: 4892)

    • Starts itself from another location

      • LB3.exe (PID: 3780)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2324)
      • sc.exe (PID: 6264)
      • sc.exe (PID: 3000)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 4836)
      • sc.exe (PID: 4864)
      • sc.exe (PID: 6104)
      • sc.exe (PID: 2292)
      • sc.exe (PID: 1324)
      • sc.exe (PID: 4688)
      • sc.exe (PID: 4868)
      • sc.exe (PID: 4824)
      • sc.exe (PID: 6900)
      • sc.exe (PID: 6472)
      • sc.exe (PID: 4500)
      • sc.exe (PID: 5924)
      • sc.exe (PID: 2972)
      • sc.exe (PID: 7124)
      • sc.exe (PID: 2620)
      • sc.exe (PID: 3964)
      • sc.exe (PID: 1984)
      • sc.exe (PID: 1932)
      • sc.exe (PID: 2964)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 7108)
      • sc.exe (PID: 4544)
      • sc.exe (PID: 3112)
      • sc.exe (PID: 2072)
      • sc.exe (PID: 3656)
      • sc.exe (PID: 3588)
      • sc.exe (PID: 5168)
      • sc.exe (PID: 6188)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 1800)
      • sc.exe (PID: 1352)
      • sc.exe (PID: 316)
      • sc.exe (PID: 6508)
      • sc.exe (PID: 4692)
      • sc.exe (PID: 6512)
      • sc.exe (PID: 5764)
      • sc.exe (PID: 6292)
      • sc.exe (PID: 6180)
      • sc.exe (PID: 620)
      • sc.exe (PID: 3388)
      • sc.exe (PID: 4172)
      • sc.exe (PID: 432)
      • sc.exe (PID: 2732)
      • sc.exe (PID: 4808)
      • sc.exe (PID: 4804)
      • sc.exe (PID: 2448)
      • sc.exe (PID: 7000)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 4844)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 4512)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 5432)
      • sc.exe (PID: 188)
      • sc.exe (PID: 5184)
      • sc.exe (PID: 6312)
      • sc.exe (PID: 472)
      • sc.exe (PID: 6536)
      • sc.exe (PID: 3788)
      • sc.exe (PID: 3876)
      • sc.exe (PID: 3620)
      • sc.exe (PID: 7156)
      • sc.exe (PID: 4196)
      • sc.exe (PID: 3652)
      • sc.exe (PID: 6684)
      • sc.exe (PID: 5928)
      • sc.exe (PID: 3396)
      • sc.exe (PID: 2464)
      • sc.exe (PID: 5284)
      • sc.exe (PID: 6572)
      • sc.exe (PID: 5496)
      • sc.exe (PID: 424)
      • sc.exe (PID: 2524)
      • sc.exe (PID: 2848)
      • sc.exe (PID: 6256)
      • sc.exe (PID: 3800)
      • sc.exe (PID: 6748)
      • sc.exe (PID: 5124)
      • sc.exe (PID: 6236)
      • sc.exe (PID: 6260)
      • sc.exe (PID: 768)
      • sc.exe (PID: 3832)
      • sc.exe (PID: 1720)
      • sc.exe (PID: 1332)
      • sc.exe (PID: 6360)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 7140)
      • sc.exe (PID: 3976)
      • sc.exe (PID: 1232)
      • sc.exe (PID: 3944)
      • sc.exe (PID: 4752)
      • sc.exe (PID: 1740)
      • sc.exe (PID: 4576)
      • sc.exe (PID: 2680)
      • sc.exe (PID: 1356)
      • sc.exe (PID: 6380)
      • sc.exe (PID: 3092)
      • sc.exe (PID: 2124)
      • sc.exe (PID: 5172)
      • sc.exe (PID: 5708)
      • sc.exe (PID: 2288)
      • sc.exe (PID: 3732)
      • sc.exe (PID: 4312)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 1080)
      • sc.exe (PID: 3148)
      • sc.exe (PID: 3936)
      • sc.exe (PID: 3760)
      • sc.exe (PID: 632)
      • sc.exe (PID: 4160)
      • sc.exe (PID: 3800)
      • sc.exe (PID: 1800)
      • sc.exe (PID: 4808)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 3588)
      • sc.exe (PID: 4168)
      • sc.exe (PID: 4156)
      • sc.exe (PID: 7032)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 5744)
      • sc.exe (PID: 3620)
      • sc.exe (PID: 5432)
      • sc.exe (PID: 6620)
      • sc.exe (PID: 3396)
      • sc.exe (PID: 6344)
      • sc.exe (PID: 6640)
      • sc.exe (PID: 6948)
      • sc.exe (PID: 2356)
      • sc.exe (PID: 2604)
      • sc.exe (PID: 3832)
      • sc.exe (PID: 768)
      • sc.exe (PID: 2620)
      • sc.exe (PID: 5348)
      • sc.exe (PID: 3768)
      • sc.exe (PID: 5252)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 1336)
      • sc.exe (PID: 5952)
      • sc.exe (PID: 1564)
      • sc.exe (PID: 2324)
      • sc.exe (PID: 6508)
      • sc.exe (PID: 4688)
      • sc.exe (PID: 1488)
      • sc.exe (PID: 2292)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 4816)
      • sc.exe (PID: 5480)
      • sc.exe (PID: 6828)
      • sc.exe (PID: 2468)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 472)
      • sc.exe (PID: 4460)
      • sc.exe (PID: 5008)
      • sc.exe (PID: 4944)
      • sc.exe (PID: 5116)
      • sc.exe (PID: 1752)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 2460)
      • sc.exe (PID: 2296)
      • sc.exe (PID: 6980)
      • sc.exe (PID: 1156)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 1096)
      • sc.exe (PID: 7156)
      • sc.exe (PID: 6528)
      • sc.exe (PID: 5288)
      • sc.exe (PID: 4040)
      • sc.exe (PID: 4844)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 5168)
      • sc.exe (PID: 1480)
      • sc.exe (PID: 1028)
      • sc.exe (PID: 2976)
      • sc.exe (PID: 3584)
      • sc.exe (PID: 2964)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 2800)
      • sc.exe (PID: 3028)
      • sc.exe (PID: 6688)

    • Starts SC.EXE for service management

      • svchost.exe (PID: 4892)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 4892)

  • INFO

    • Reads the computer name

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Checks supported languages

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Create files in a temporary directory

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Reads the machine GUID from the registry

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Creates files or folders in the user directory

      • LB3.exe (PID: 3780)

    • Process checks computer location settings

      • LB3.exe (PID: 3780)
      • svchost.exe (PID: 4892)

    • Launching a file from a Registry key

      • svchost.exe (PID: 4892)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • svchost.exe (PID: 4892)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2732)
      • WMIC.exe (PID: 1096)
      • notepad.exe (PID: 4476)

    • Manual execution by a user

      • notepad.exe (PID: 4476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:22 15:24:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 92160
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1871e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: LB3.exe
LegalCopyright:
OriginalFileName: LB3.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
856
Monitored processes
721
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start lb3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs #LOCKBIT svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs schtasks.exe no specs conhost.exe no specs timeout.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs fodhelper.exe no specs fodhelper.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe fodhelper.exe no specs vssadmin.exe no specs conhost.exe no specs fodhelper.exe no specs vssadmin.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs wbadmin.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs net1.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs net1.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs notepad.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs slui.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
188"sc.exe" config veeam start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
188C:\WINDOWS\system32\net1 stop GXMMMC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\ucrtbase.dll
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236"net.exe" stop mysqlC:\Windows\System32\net.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
316"sc.exe" delete svc$C:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
316"net.exe" stop BackupExecJobEngineC:\Windows\System32\net.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 248
Read events
10 236
Write events
12
Delete events
0

Modification events

(PID) Process:(4892) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:UpdateHiY08s
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(4892) svchost.exeKey:HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command
Operation:writeName:DelegateExecute
Value:
Executable files
12
Suspicious files
82
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
3780LB3.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_u3BMBm80.battext
MD5:98EC0893542F27D9CB66F211A8623F74
SHA256:682C08D1E8363272024133D9C0F84BEC7F153847B3738887C801DCA692CA5A6E
3780LB3.exeC:\Users\admin\AppData\Local\svchost.exeexecutable
MD5:7E94169D448A160D8649BE4FDDF49116
SHA256:42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90
3780LB3.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_pPE7QIyG.battext
MD5:98EC0893542F27D9CB66F211A8623F74
SHA256:682C08D1E8363272024133D9C0F84BEC7F153847B3738887C801DCA692CA5A6E
4892svchost.exeC:\Users\admin\AppData\Local\Temp\update_GNXeHs.exeexecutable
MD5:7E94169D448A160D8649BE4FDDF49116
SHA256:42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90
3780LB3.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_YqFbX6lI.battext
MD5:98EC0893542F27D9CB66F211A8623F74
SHA256:682C08D1E8363272024133D9C0F84BEC7F153847B3738887C801DCA692CA5A6E
4892svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_fA4Xv2AW.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
4892svchost.exeC:\Users\admin\AppData\Local\Temp\update_7BjToq.exeexecutable
MD5:7E94169D448A160D8649BE4FDDF49116
SHA256:42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90
4892svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_8lnqvidX.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
4892svchost.exeC:\Users\admin\AppData\Local\Temp\update_TkLpHu.exeexecutable
MD5:7E94169D448A160D8649BE4FDDF49116
SHA256:42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90
4892svchost.exeC:\Users\admin\AppData\Local\Temp\update_fXPiDc.exeexecutable
MD5:7E94169D448A160D8649BE4FDDF49116
SHA256:42B3245E110BD6C810060C9EEAA66114CD37B1E8A733B18C3963CD42F81F0D90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5692
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5232
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5232
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.1
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.64
  • 40.126.31.2
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LB3.exe