File name:

BlackMatter.exe

Full analysis: https://app.any.run/tasks/4e24ee26-23df-4196-a0b4-4ac48f4b13ad
Verdict: Malicious activity
Threats:

BlackMatter is a ransomware strain operating as a Ransomware-as-a-Service (RaaS), designed to encrypt files, remove recovery options, and extort victims across critical industries. Emerging in 2021, it quickly became a major concern due to its ability to evade defenses, spread across networks, and cause large-scale operational disruption, forcing security teams to act against a highly destructive and persistent threat.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:40:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
uac
blackmatter
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

4B3A3DB4C9BBA95AF2126DF14DCBDBA2

SHA1:

88C64F0C3B0CA1B47180B8812BA64E10ADC8475F

SHA256:

4F696E53BEB0795A682B3B0D9C254803929FDD35568404A814A1A067B8043C83

SSDEEP:

24576:83yvjZF6cwmJyFW1t5M9w/vgS2YhDE11BWCQgsnEhnzJF24WtHS7Ve:R1t5M9w/vgS2YhDE11BWCQgsnENz324K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMATTER mutex has been found

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Uses Task Scheduler to autorun other applications

      • svchost.exe (PID: 4476)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 4476)

    • Deletes shadow copies

      • svchost.exe (PID: 4476)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 3740)

    • Bypass User Account Control (Modify registry)

      • svchost.exe (PID: 4476)

    • Starts NET.EXE for service management

      • svchost.exe (PID: 4476)
      • net.exe (PID: 6672)
      • net.exe (PID: 4888)
      • net.exe (PID: 4700)
      • net.exe (PID: 2512)
      • net.exe (PID: 4868)
      • net.exe (PID: 4100)
      • net.exe (PID: 7056)
      • net.exe (PID: 4372)
      • net.exe (PID: 4664)
      • net.exe (PID: 4648)
      • net.exe (PID: 3196)
      • net.exe (PID: 7056)
      • net.exe (PID: 6896)
      • net.exe (PID: 3640)
      • net.exe (PID: 432)
      • net.exe (PID: 3196)
      • net.exe (PID: 2552)
      • net.exe (PID: 4768)
      • net.exe (PID: 640)
      • net.exe (PID: 5708)
      • net.exe (PID: 1028)
      • net.exe (PID: 7116)
      • net.exe (PID: 6900)
      • net.exe (PID: 5644)
      • net.exe (PID: 7092)
      • net.exe (PID: 3100)
      • net.exe (PID: 2460)
      • net.exe (PID: 5496)
      • net.exe (PID: 6236)
      • net.exe (PID: 5600)
      • net.exe (PID: 4700)
      • net.exe (PID: 3580)
      • net.exe (PID: 4700)
      • net.exe (PID: 2804)
      • net.exe (PID: 6612)
      • net.exe (PID: 3640)
      • net.exe (PID: 6164)
      • net.exe (PID: 5620)
      • net.exe (PID: 6572)
      • net.exe (PID: 5352)
      • net.exe (PID: 1564)
      • net.exe (PID: 768)
      • net.exe (PID: 516)
      • net.exe (PID: 6164)
      • net.exe (PID: 6896)
      • net.exe (PID: 2680)
      • net.exe (PID: 768)
      • net.exe (PID: 5768)
      • net.exe (PID: 480)
      • net.exe (PID: 5600)
      • net.exe (PID: 6404)
      • net.exe (PID: 6516)
      • net.exe (PID: 6380)
      • net.exe (PID: 6956)
      • net.exe (PID: 5708)
      • net.exe (PID: 4768)
      • net.exe (PID: 2864)
      • net.exe (PID: 4500)
      • net.exe (PID: 2276)
      • net.exe (PID: 3972)
      • net.exe (PID: 5252)
      • net.exe (PID: 5252)
      • net.exe (PID: 2220)
      • net.exe (PID: 2460)
      • net.exe (PID: 6460)
      • net.exe (PID: 6192)
      • net.exe (PID: 5616)
      • net.exe (PID: 4156)
      • net.exe (PID: 6900)
      • net.exe (PID: 2356)
      • net.exe (PID: 756)
      • net.exe (PID: 6004)
      • net.exe (PID: 724)
      • net.exe (PID: 2972)
      • net.exe (PID: 6896)
      • net.exe (PID: 1136)
      • net.exe (PID: 868)
      • net.exe (PID: 2032)
      • net.exe (PID: 3972)
      • net.exe (PID: 2324)
      • net.exe (PID: 592)
      • net.exe (PID: 5244)
      • net.exe (PID: 6948)
      • net.exe (PID: 6124)
      • net.exe (PID: 6840)
      • net.exe (PID: 188)
      • net.exe (PID: 6384)
      • net.exe (PID: 1984)
      • net.exe (PID: 7056)
      • net.exe (PID: 2028)
      • net.exe (PID: 2292)
      • net.exe (PID: 6296)
      • net.exe (PID: 1232)
      • net.exe (PID: 6256)
      • net.exe (PID: 5564)
      • net.exe (PID: 6320)
      • net.exe (PID: 5240)
      • net.exe (PID: 3672)
      • net.exe (PID: 4920)
      • net.exe (PID: 3160)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2460)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6360)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 4984)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 3636)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 1688)

    • The process creates files with name similar to system file names

      • LB3.exe (PID: 5616)

    • Reads security settings of Internet Explorer

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Executable content was dropped or overwritten

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Starts CMD.EXE for commands execution

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Reads the date of Windows installation

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Starts itself from another location

      • LB3.exe (PID: 5616)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5876)
      • sc.exe (PID: 5432)
      • sc.exe (PID: 1872)
      • sc.exe (PID: 3980)
      • sc.exe (PID: 2648)
      • sc.exe (PID: 7076)
      • sc.exe (PID: 2140)
      • sc.exe (PID: 3964)
      • sc.exe (PID: 5124)
      • sc.exe (PID: 2604)
      • sc.exe (PID: 1356)
      • sc.exe (PID: 1488)
      • sc.exe (PID: 2952)
      • sc.exe (PID: 4828)
      • sc.exe (PID: 5928)
      • sc.exe (PID: 2072)
      • sc.exe (PID: 1984)
      • sc.exe (PID: 6772)
      • sc.exe (PID: 6800)
      • sc.exe (PID: 2800)
      • sc.exe (PID: 1508)
      • sc.exe (PID: 6188)
      • sc.exe (PID: 6732)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 6960)
      • sc.exe (PID: 4088)
      • sc.exe (PID: 1068)
      • sc.exe (PID: 6004)
      • sc.exe (PID: 5348)
      • sc.exe (PID: 7000)
      • sc.exe (PID: 5480)
      • sc.exe (PID: 2716)
      • sc.exe (PID: 4576)
      • sc.exe (PID: 3572)
      • sc.exe (PID: 6256)
      • sc.exe (PID: 4648)
      • sc.exe (PID: 4664)
      • sc.exe (PID: 5560)
      • sc.exe (PID: 4864)
      • sc.exe (PID: 1688)
      • sc.exe (PID: 5424)
      • sc.exe (PID: 6176)
      • sc.exe (PID: 3476)
      • sc.exe (PID: 3800)
      • sc.exe (PID: 4232)
      • sc.exe (PID: 4892)
      • sc.exe (PID: 3720)
      • sc.exe (PID: 4100)
      • sc.exe (PID: 2116)
      • sc.exe (PID: 6216)
      • sc.exe (PID: 420)
      • sc.exe (PID: 2620)
      • sc.exe (PID: 2272)
      • sc.exe (PID: 4868)
      • sc.exe (PID: 1700)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 7160)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 5244)
      • sc.exe (PID: 4860)
      • sc.exe (PID: 6948)
      • sc.exe (PID: 6232)
      • sc.exe (PID: 3756)
      • sc.exe (PID: 1740)
      • sc.exe (PID: 6360)
      • sc.exe (PID: 6756)
      • sc.exe (PID: 4456)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 5712)
      • sc.exe (PID: 7128)
      • sc.exe (PID: 3636)
      • sc.exe (PID: 4116)
      • sc.exe (PID: 3624)
      • sc.exe (PID: 6892)
      • sc.exe (PID: 1812)
      • sc.exe (PID: 6260)
      • sc.exe (PID: 7100)
      • sc.exe (PID: 6636)
      • sc.exe (PID: 6420)
      • sc.exe (PID: 5620)
      • sc.exe (PID: 424)
      • sc.exe (PID: 2280)
      • sc.exe (PID: 2032)
      • sc.exe (PID: 6356)
      • sc.exe (PID: 4752)
      • sc.exe (PID: 2552)
      • sc.exe (PID: 6352)
      • sc.exe (PID: 6384)
      • sc.exe (PID: 6264)
      • sc.exe (PID: 4920)
      • sc.exe (PID: 3100)
      • sc.exe (PID: 4192)
      • sc.exe (PID: 7072)
      • sc.exe (PID: 1100)
      • sc.exe (PID: 6320)
      • sc.exe (PID: 2532)
      • sc.exe (PID: 432)
      • sc.exe (PID: 3480)
      • sc.exe (PID: 3672)
      • sc.exe (PID: 5352)
      • sc.exe (PID: 4156)
      • sc.exe (PID: 6368)
      • sc.exe (PID: 7028)
      • sc.exe (PID: 7004)
      • sc.exe (PID: 5600)
      • sc.exe (PID: 6364)
      • sc.exe (PID: 5416)
      • sc.exe (PID: 5476)
      • sc.exe (PID: 1752)
      • sc.exe (PID: 2288)
      • sc.exe (PID: 6528)
      • sc.exe (PID: 1028)
      • sc.exe (PID: 6508)
      • sc.exe (PID: 3608)
      • sc.exe (PID: 6400)
      • sc.exe (PID: 7124)
      • sc.exe (PID: 5116)
      • sc.exe (PID: 5504)
      • sc.exe (PID: 3748)
      • sc.exe (PID: 472)
      • sc.exe (PID: 2464)
      • sc.exe (PID: 6664)
      • sc.exe (PID: 3652)
      • sc.exe (PID: 1480)
      • sc.exe (PID: 1268)
      • sc.exe (PID: 6896)
      • sc.exe (PID: 3880)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 4880)
      • sc.exe (PID: 1212)
      • sc.exe (PID: 4324)
      • sc.exe (PID: 2168)
      • sc.exe (PID: 3640)
      • sc.exe (PID: 5444)
      • sc.exe (PID: 4100)
      • sc.exe (PID: 3740)
      • sc.exe (PID: 2964)
      • sc.exe (PID: 6304)
      • sc.exe (PID: 5744)
      • sc.exe (PID: 2368)
      • sc.exe (PID: 5348)
      • sc.exe (PID: 6832)
      • sc.exe (PID: 5168)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 5616)
      • sc.exe (PID: 5652)
      • sc.exe (PID: 640)
      • sc.exe (PID: 3092)
      • sc.exe (PID: 4232)
      • sc.exe (PID: 3740)
      • sc.exe (PID: 4884)
      • sc.exe (PID: 4864)
      • sc.exe (PID: 424)
      • sc.exe (PID: 2648)
      • sc.exe (PID: 2728)
      • sc.exe (PID: 3852)
      • sc.exe (PID: 1136)
      • sc.exe (PID: 2296)
      • sc.exe (PID: 3724)
      • sc.exe (PID: 3676)
      • sc.exe (PID: 3720)
      • sc.exe (PID: 5116)
      • sc.exe (PID: 3748)
      • sc.exe (PID: 1740)
      • sc.exe (PID: 4684)
      • sc.exe (PID: 3048)
      • sc.exe (PID: 1080)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 5032)
      • sc.exe (PID: 1688)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 1932)
      • sc.exe (PID: 2428)
      • sc.exe (PID: 7124)
      • sc.exe (PID: 2460)
      • sc.exe (PID: 3964)
      • sc.exe (PID: 6192)
      • sc.exe (PID: 3924)
      • sc.exe (PID: 984)
      • sc.exe (PID: 6160)
      • sc.exe (PID: 3196)
      • sc.exe (PID: 2324)
      • sc.exe (PID: 3732)
      • sc.exe (PID: 5172)
      • sc.exe (PID: 6384)
      • sc.exe (PID: 6360)
      • sc.exe (PID: 5140)
      • sc.exe (PID: 5896)
      • sc.exe (PID: 5952)
      • sc.exe (PID: 2028)
      • sc.exe (PID: 3628)
      • sc.exe (PID: 3844)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 5556)
      • sc.exe (PID: 5600)
      • sc.exe (PID: 1984)
      • sc.exe (PID: 4456)
      • sc.exe (PID: 6536)
      • sc.exe (PID: 6612)

    • Changes default file association

      • svchost.exe (PID: 4476)

    • Starts SC.EXE for service management

      • svchost.exe (PID: 4476)

  • INFO

    • Manual execution by a user

      • LB3.exe (PID: 5616)

    • Reads the machine GUID from the registry

      • BlackMatter.exe (PID: 3872)
      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Checks supported languages

      • BlackMatter.exe (PID: 3872)
      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Reads the computer name

      • BlackMatter.exe (PID: 3872)
      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Create files in a temporary directory

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Creates files or folders in the user directory

      • LB3.exe (PID: 5616)

    • Process checks computer location settings

      • LB3.exe (PID: 5616)
      • svchost.exe (PID: 4476)

    • Launching a file from a Registry key

      • svchost.exe (PID: 4476)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6260)

    • Checks proxy server information

      • slui.exe (PID: 4236)

    • Reads the software policy settings

      • slui.exe (PID: 4236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2065:04:15 04:00:34+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 485888
InitializedDataSize: 237056
UninitializedDataSize: -
EntryPoint: 0x78926
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: BlackMatter 1.7 Source Extracted by HeightCoder
CompanyName: -
FileDescription: BlackMatter
FileVersion: 1.0.0.0
InternalName: BlackMatter.exe
LegalCopyright: Copyright © HeightCoder 2024
LegalTrademarks: -
OriginalFileName: BlackMatter.exe
ProductName: BlackMatter
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
893
Monitored processes
757
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start blackmatter.exe no specs lb3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs schtasks.exe no specs conhost.exe no specs timeout.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs fodhelper.exe no specs fodhelper.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe fodhelper.exe no specs vssadmin.exe no specs conhost.exe no specs fodhelper.exe no specs vssadmin.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe no specs wbadmin.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs slui.exe net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
188C:\WINDOWS\system32\net1 stop BackupExecJobEngineC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
188"net.exe" stop GxFWDC:\Windows\System32\net.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\mpr.dll
c:\windows\system32\rpcrt4.dll
320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
320C:\WINDOWS\system32\net1 stop svc$C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
420"sc.exe" config sophos start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
424"sc.exe" config WSBExchange start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
424"sc.exe" config GxCVD start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
432"net.exe" stop mysql$C:\Windows\System32\net.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
10 132
Read events
10 120
Write events
12
Delete events
0

Modification events

(PID) Process:(4476) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:UpdatefeTloa
Value:
C:\Users\admin\AppData\Local\svchost.exe
(PID) Process:(4476) svchost.exeKey:HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command
Operation:writeName:DelegateExecute
Value:
Executable files
14
Suspicious files
98
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
4476svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_5cwi9F3Q.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
4476svchost.exeC:\Users\admin\AppData\Local\Temp\update_egjxEN.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
4476svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_vspz2qE5.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
4476svchost.exeC:\Users\admin\AppData\Local\Temp\update_4e4LrX.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
4476svchost.exeC:\Users\admin\AppData\Local\Temp\update_EFPagz.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
4476svchost.exeC:\Users\admin\AppData\Local\Temp\update_owiLq3.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
5616LB3.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_K4a4BKYO.battext
MD5:87ED01DFF112430A5302F4BE38D4D7BB
SHA256:9B2C925CF92955588FC7A69D495EE6D26EFE88CDC17A0357D7971AFB2719A11D
4476svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_XS7Laqja.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
4476svchost.exeC:\Users\admin\AppData\Local\Temp\update_FKhOqN.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
5616LB3.exeC:\Users\admin\AppData\Local\svchost.exeexecutable
MD5:845A7611B35C48AE648393A8EE1485EB
SHA256:279508DD73AB11F2B0E60BE6C7176A32C7199A08CE6ABD170D598040B4D09EAC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1200
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2296
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2296
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2324
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1200
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1200
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.71
  • 40.126.31.2
  • 40.126.31.131
  • 20.190.159.0
  • 20.190.159.130
  • 20.190.159.129
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlackMatter.exe