File name:

bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe

Full analysis: https://app.any.run/tasks/3a712e2b-0e35-407d-a029-071cfd234088
Verdict: Malicious activity
Threats:

BlackMatter is a ransomware strain operating as a Ransomware-as-a-Service (RaaS), designed to encrypt files, remove recovery options, and extort victims across critical industries. Emerging in 2021, it quickly became a major concern due to its ability to evade defenses, spread across networks, and cause large-scale operational disruption, forcing security teams to act against a highly destructive and persistent threat.

Malware Trends Tracker     >>>
Analysis date: June 30, 2025, 00:29:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
blackmatter
ransomware
darkside
uac
lockbit3
lockbit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

8BD508F5576755314DC82874459086BF

SHA1:

F2781AE5FEE63C7B4980AB55A767F40F408FBB88

SHA256:

B4F8F6956FD93483275713CAF492EA2C7992C9D04DE519071C5D8CDDBDBEB71F

SSDEEP:

3072:pylm0YFOZa+Er7Hcun2TIA6j6gTJKCpzQW9cXhNrz1:dffjtTJBQW9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BLACKMATTER mutex has been found

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • DARKSIDE mutex has been found

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Deletes shadow copies

      • svchost.exe (PID: 7004)
      • cmd.exe (PID: 4664)

    • Bypass User Account Control (Modify registry)

      • svchost.exe (PID: 7004)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7004)

    • Uses Task Scheduler to autorun other applications

      • svchost.exe (PID: 7004)

    • LOCKBIT3 has been detected

      • svchost.exe (PID: 7004)

    • BLACKMATTER has been detected (SURICATA)

      • svchost.exe (PID: 2200)

    • Connects to the CnC server

      • svchost.exe (PID: 2200)

    • [YARA] LockBit is detected

      • svchost.exe (PID: 7004)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 4664)

    • Starts NET.EXE for service management

      • net.exe (PID: 5020)
      • net.exe (PID: 1512)
      • net.exe (PID: 5744)
      • net.exe (PID: 4824)
      • svchost.exe (PID: 7004)
      • net.exe (PID: 6828)
      • net.exe (PID: 4084)
      • net.exe (PID: 4500)
      • net.exe (PID: 6516)
      • net.exe (PID: 6176)
      • net.exe (PID: 2680)
      • net.exe (PID: 3760)
      • net.exe (PID: 6672)
      • net.exe (PID: 6820)
      • net.exe (PID: 3976)
      • net.exe (PID: 6004)
      • net.exe (PID: 6940)
      • net.exe (PID: 3788)
      • net.exe (PID: 4324)
      • net.exe (PID: 6512)
      • net.exe (PID: 4664)
      • net.exe (PID: 6148)
      • net.exe (PID: 3572)
      • net.exe (PID: 6384)
      • net.exe (PID: 6896)
      • net.exe (PID: 2716)
      • net.exe (PID: 1632)
      • net.exe (PID: 1520)
      • net.exe (PID: 6376)
      • net.exe (PID: 3860)
      • net.exe (PID: 1356)
      • net.exe (PID: 2072)
      • net.exe (PID: 5400)
      • net.exe (PID: 6348)
      • net.exe (PID: 6268)
      • net.exe (PID: 6256)
      • net.exe (PID: 2732)
      • net.exe (PID: 6212)
      • net.exe (PID: 3584)

    • DARKSIDE has been detected (SURICATA)

      • svchost.exe (PID: 7004)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Executing commands from a ".bat" file

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 4400)
      • cmd.exe (PID: 1700)
      • cmd.exe (PID: 6256)
      • cmd.exe (PID: 1880)
      • cmd.exe (PID: 3392)

    • The process creates files with name similar to system file names

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)

    • Executable content was dropped or overwritten

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Reads security settings of Internet Explorer

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Reads the date of Windows installation

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Starts itself from another location

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)

    • Changes default file association

      • svchost.exe (PID: 7004)

    • Hides command output

      • cmd.exe (PID: 6492)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2200)
      • svchost.exe (PID: 7004)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 7004)

    • Connects to the server without a host name

      • svchost.exe (PID: 7004)

    • Starts SC.EXE for service management

      • svchost.exe (PID: 7004)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3872)
      • sc.exe (PID: 6472)
      • sc.exe (PID: 6412)
      • sc.exe (PID: 5720)
      • sc.exe (PID: 2136)
      • sc.exe (PID: 2228)
      • sc.exe (PID: 4788)
      • sc.exe (PID: 2468)
      • sc.exe (PID: 684)
      • sc.exe (PID: 6776)
      • sc.exe (PID: 2128)
      • sc.exe (PID: 2804)
      • sc.exe (PID: 2180)
      • sc.exe (PID: 5712)
      • sc.exe (PID: 2664)
      • sc.exe (PID: 7092)
      • sc.exe (PID: 3788)
      • sc.exe (PID: 316)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 6376)
      • sc.exe (PID: 2464)
      • sc.exe (PID: 6400)
      • sc.exe (PID: 1812)
      • sc.exe (PID: 3844)
      • sc.exe (PID: 5372)
      • sc.exe (PID: 7052)
      • sc.exe (PID: 5968)
      • sc.exe (PID: 6700)
      • sc.exe (PID: 5876)
      • sc.exe (PID: 7160)
      • sc.exe (PID: 6780)
      • sc.exe (PID: 416)
      • sc.exe (PID: 3572)
      • sc.exe (PID: 6172)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 6256)
      • sc.exe (PID: 4760)
      • sc.exe (PID: 2732)
      • sc.exe (PID: 3584)
      • sc.exe (PID: 5924)
      • sc.exe (PID: 2612)
      • sc.exe (PID: 2876)
      • sc.exe (PID: 7080)
      • sc.exe (PID: 3936)
      • sc.exe (PID: 6516)
      • sc.exe (PID: 4216)
      • sc.exe (PID: 4800)
      • sc.exe (PID: 1700)
      • sc.exe (PID: 4324)
      • sc.exe (PID: 1180)
      • sc.exe (PID: 6492)
      • sc.exe (PID: 6164)
      • sc.exe (PID: 6220)
      • sc.exe (PID: 3956)
      • sc.exe (PID: 1932)
      • sc.exe (PID: 4768)
      • sc.exe (PID: 4412)
      • sc.exe (PID: 2124)
      • sc.exe (PID: 6820)
      • sc.exe (PID: 7000)
      • sc.exe (PID: 6876)
      • sc.exe (PID: 5876)
      • sc.exe (PID: 1948)
      • sc.exe (PID: 3788)
      • sc.exe (PID: 5920)
      • sc.exe (PID: 7136)
      • sc.exe (PID: 5556)
      • sc.exe (PID: 5992)
      • sc.exe (PID: 2380)
      • sc.exe (PID: 4916)
      • sc.exe (PID: 5172)
      • sc.exe (PID: 2716)
      • sc.exe (PID: 1296)
      • sc.exe (PID: 1100)
      • sc.exe (PID: 4664)
      • sc.exe (PID: 4552)

  • INFO

    • Checks supported languages

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Reads the computer name

      • svchost.exe (PID: 7004)
      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)

    • Create files in a temporary directory

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Reads the machine GUID from the registry

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Creates files or folders in the user directory

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)

    • Process checks computer location settings

      • bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe (PID: 3540)
      • svchost.exe (PID: 7004)

    • Launching a file from a Registry key

      • svchost.exe (PID: 7004)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1128)

    • Checks proxy server information

      • svchost.exe (PID: 7004)

    • Disables trace logs

      • svchost.exe (PID: 7004)

    • Reads Environment values

      • svchost.exe (PID: 7004)

    • Reads the software policy settings

      • svchost.exe (PID: 7004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:30 00:29:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 111616
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x1d3be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe
LegalCopyright:
OriginalFileName: bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
453
Monitored processes
322
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs #LOCKBIT svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs schtasks.exe no specs conhost.exe no specs timeout.exe no specs fodhelper.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs #BLACKMATTER svchost.exe fodhelper.exe no specs fodhelper.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs net1.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs slui.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs net1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32C:\WINDOWS\system32\net1 stop memtasC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
316"sc.exe" config mysql start=disabledC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
416"sc.exe" delete svc$C:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
416C:\WINDOWS\system32\net1 stop mepocsC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"sc.exe" delete vssC:\Windows\System32\sc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
760"C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Features On Demand Helper
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fodhelper.exe
c:\windows\system32\ntdll.dll
768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 468
Read events
6 462
Write events
6
Delete events
0

Modification events

(PID) Process:(7004) svchost.exeKey:HKEY_CLASSES_ROOT\ms-settings\Shell\Open\command
Operation:writeName:DelegateExecute
Value:
(PID) Process:(7004) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Update1Rvsum
Value:
C:\Users\admin\AppData\Local\svchost.exe
Executable files
6
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3540bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_wHlkbdMQ.battext
MD5:61CCDB033029D1B928F89FB81B781F03
SHA256:DFB50109E1DCAF9C0F48B6A893BAD81540DD408AE8D617DC9955527D97A959E3
7004svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_mQpeUD5a.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
7004svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_xvX7XS5v.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
7004svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_G9WOzewg.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
3540bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_T4cHz8Nq.battext
MD5:61CCDB033029D1B928F89FB81B781F03
SHA256:DFB50109E1DCAF9C0F48B6A893BAD81540DD408AE8D617DC9955527D97A959E3
7004svchost.exeC:\Users\admin\AppData\Local\Temp\selfdestruct_7qBSNqyy.battext
MD5:80384AC2A6120ACBE512303AEBC66A1D
SHA256:169674D683BE5127DF6B0817287779B6292835BD97B12785ED9243543B823505
7004svchost.exeC:\Users\admin\AppData\Local\Temp\update_Wiry35.exeexecutable
MD5:8BD508F5576755314DC82874459086BF
SHA256:B4F8F6956FD93483275713CAF492EA2C7992C9D04DE519071C5D8CDDBDBEB71F
3540bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exeC:\Users\admin\AppData\Local\svchost.exeexecutable
MD5:8BD508F5576755314DC82874459086BF
SHA256:B4F8F6956FD93483275713CAF492EA2C7992C9D04DE519071C5D8CDDBDBEB71F
7004svchost.exeC:\Users\admin\AppData\Local\Temp\update_cHL3BS.exeexecutable
MD5:8BD508F5576755314DC82874459086BF
SHA256:B4F8F6956FD93483275713CAF492EA2C7992C9D04DE519071C5D8CDDBDBEB71F
7004svchost.exeC:\Users\admin\AppData\Local\Temp\update_LUkLTF.exeexecutable
MD5:8BD508F5576755314DC82874459086BF
SHA256:B4F8F6956FD93483275713CAF492EA2C7992C9D04DE519071C5D8CDDBDBEB71F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
22
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7004
svchost.exe
GET
400
31.14.70.252:443
http://store10.gofile.io:443/download/web/db662021-156c-4d81-8c48-4db9f30a0214/icon.ico
unknown
—
—
whitelisted
7004
svchost.exe
GET
200
199.59.243.228:80
http://survey-smiles.com/
unknown
—
—
whitelisted
7004
svchost.exe
GET
302
77.247.179.85:80
http://77.247.179.85/
unknown
—
—
unknown
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
436
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4680
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4680
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7004
svchost.exe
GET
200
3.33.130.190:80
http://mojobiden.com/
unknown
—
—
malicious
7004
svchost.exe
GET
200
5.255.108.35:80
http://5.255.108.35/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2664
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7004
svchost.exe
3.33.130.190:443
mojobiden.com
AMAZON-02
US
malicious
436
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
mojobiden.com
  • 3.33.130.190
  • 15.197.148.33
malicious
login.live.com
  • 20.190.159.73
  • 20.190.159.129
  • 20.190.159.131
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.2
  • 40.126.31.130
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
2200
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE BlackMatter CnC Domain in DNS Lookup (paymenthacks .com)
7004
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed DarkSide Ransomware Domain (baroquetees .com in TLS SNI)
2200
svchost.exe
Potentially Bad Traffic
ET FILE_SHARING Online File Storage Domain in DNS Lookup (gofile .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bgpg22s67xk5ydnqmc0hsb0lkbmx7wg0ja0u436qz2gdmrph8fm4km222bsgepvm.exe