URL:

https://lenovomm.com/

Full analysis: https://app.any.run/tasks/3d49877b-5145-4af4-adcd-53f07a535cae
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 19, 2025, 02:03:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-html
stealer
arch-exec
Indicators:
MD5:

51634EA630C0AF03AAF21F4D21A7B417

SHA1:

D26CC3C0E52DB96D639A41ED1A98C35F361C0A0B

SHA256:

EF4B27477972C8F8D5EB4A2F1F4A6DC9563C6FD243A16111BAFFBF685C13396C

SSDEEP:

3:N8ALIIn:2AsI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASPac.exe (PID: 7520)

    • Executing a file with an untrusted certificate

      • Lsf.exe (PID: 5188)
      • Lsf.exe (PID: 4180)

    • Starts NET.EXE for service management

      • Store-ind-10002.exe (PID: 1040)
      • net.exe (PID: 7524)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Store-ind-10002.exe (PID: 1040)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LISFProt.exe (PID: 240)
      • lsfinstall.exe (PID: 4696)
      • 帝王霸业.exe (PID: 2812)
      • LeASHive.exe (PID: 1196)
      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)

    • Executes application which crashes

      • Store-ind-10002.exe (PID: 7020)

    • Executes as Windows Service

      • WmiApSrv.exe (PID: 632)
      • Locator.exe (PID: 7968)
      • LISFService.exe (PID: 2084)
      • LenovoServiceAS.exe (PID: 4272)

    • Process drops legitimate windows executable

      • Store-ind-10002.exe (PID: 1040)
      • 帝王霸业.exe (PID: 2812)

    • Reads security settings of Internet Explorer

      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LISFProt.exe (PID: 240)
      • LISFProt.exe (PID: 132)
      • lsfinstall.exe (PID: 4696)
      • LeASPac.exe (PID: 7520)
      • LeAppOM.exe (PID: 6228)
      • LockScreenMain.exe (PID: 7548)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)

    • Creates a software uninstall entry

      • Store-ind-10002.exe (PID: 1040)
      • 帝王霸业.exe (PID: 2812)

    • Starts POWERSHELL.EXE for commands execution

      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASPac.exe (PID: 7520)
      • LenovoAppStore.exe (PID: 5796)

    • The process bypasses the loading of PowerShell profile settings

      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASPac.exe (PID: 7520)
      • LenovoAppStore.exe (PID: 5796)

    • Reads the date of Windows installation

      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LeASPac.exe (PID: 7520)
      • LockScreenMain.exe (PID: 7548)
      • pwsh.exe (PID: 8772)
      • LeASHive.exe (PID: 1196)

    • Searches for installed software

      • LeASLane.exe (PID: 8040)
      • LockScreenMain.exe (PID: 7548)
      • LeAppOM.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LenovoAppStore.exe (PID: 5528)
      • LenovoAppStore.exe (PID: 4452)
      • LenovoAppStore.exe (PID: 5124)
      • LeASLane.exe (PID: 6500)
      • LenovoAppStore.exe (PID: 6184)
      • LenovoAppStore.exe (PID: 5796)

    • Drops a system driver (possible attempt to evade defenses)

      • LISFInstall.exe (PID: 7404)
      • LISFProt.exe (PID: 240)

    • Creates or modifies Windows services

      • LISFInstall.exe (PID: 7404)
      • LISFProt.exe (PID: 240)

    • Creates files in the driver directory

      • LISFProt.exe (PID: 240)

    • Connects to unusual port

      • LenovoInternetSoftwareFramework.exe (PID: 2664)

    • Starts CMD.EXE for commands execution

      • lsfinstall.exe (PID: 4696)
      • LockScreenMain.exe (PID: 7548)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 4304)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 7936)
      • cmd.exe (PID: 6252)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 2504)
      • schtasks.exe (PID: 7864)
      • schtasks.exe (PID: 5952)
      • schtasks.exe (PID: 4272)
      • schtasks.exe (PID: 3676)
      • schtasks.exe (PID: 7416)
      • schtasks.exe (PID: 928)
      • schtasks.exe (PID: 5776)
      • schtasks.exe (PID: 7020)
      • schtasks.exe (PID: 8064)

    • Application launched itself

      • LockScreenMain.exe (PID: 7548)
      • LenovoAppStore.exe (PID: 5796)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 840)
      • regsvr32.exe (PID: 3176)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 6872)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 240)
      • cmd.exe (PID: 6872)

    • Creates file in the systems drive root

      • LenovoAppStore.exe (PID: 5796)

    • The process creates files with name similar to system file names

      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)
      • 帝王霸业.exe (PID: 2812)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)

    • Drops 7-zip archiver for unpacking

      • 帝王霸业.exe (PID: 2812)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 3332)

    • Manual execution by a user

      • cmd.exe (PID: 8008)
      • Store-ind-10002.exe (PID: 5048)
      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • pwsh.exe (PID: 8772)

    • Gets the hash of the file via CERTUTIL.EXE

      • certutil.exe (PID: 920)

    • Creates files or folders in the user directory

      • Store-ind-10002.exe (PID: 7020)
      • WerFault.exe (PID: 7616)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LISFService.exe (PID: 2084)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • Lsf.exe (PID: 5188)
      • LeASPac.exe (PID: 7520)
      • LeAppOM.exe (PID: 6228)
      • LenovoAppStore.exe (PID: 5796)
      • LenovoAppStore.exe (PID: 6184)
      • LeASHive.exe (PID: 1196)
      • 帝王霸业.exe (PID: 2812)

    • Reads the software policy settings

      • slui.exe (PID: 7768)
      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • slui.exe (PID: 5116)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFService.exe (PID: 2084)
      • LISFInstall.exe (PID: 7404)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LISFProt.exe (PID: 240)
      • LISFProt.exe (PID: 132)
      • LeASPac.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LeASPac.exe (PID: 7152)
      • LeAppOM.exe (PID: 6228)
      • LockScreenMain.exe (PID: 7548)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)

    • The sample compiled with english language support

      • chrome.exe (PID: 6632)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LISFInstall.exe (PID: 7404)
      • Store-ind-10002.exe (PID: 7020)
      • LISFProt.exe (PID: 240)
      • LeASHive.exe (PID: 1196)
      • 帝王霸业.exe (PID: 2812)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6632)
      • chrome.exe (PID: 3332)

    • Reads the computer name

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LISFService.exe (PID: 2084)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LISFProt.exe (PID: 240)
      • LISFProt.exe (PID: 132)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • Lsf.exe (PID: 5188)
      • LenovoServiceAS.exe (PID: 3828)
      • LenovoServiceAS.exe (PID: 7836)
      • LenovoServiceAS.exe (PID: 4272)
      • LeASPac.exe (PID: 7520)
      • LockScreenMain.exe (PID: 7548)
      • LeAppOM.exe (PID: 6228)
      • LockScreenMain.exe (PID: 7596)
      • LeASPac.exe (PID: 7152)
      • LockScreenAssist.exe (PID: 7956)
      • LenovoAppStore.exe (PID: 5796)
      • LenovoAppStore.exe (PID: 5528)
      • LenovoAppStore.exe (PID: 4452)
      • LenovoAppStore.exe (PID: 6184)
      • LenovoAppStore.exe (PID: 5124)
      • LeAppStoreTray.exe (PID: 6068)
      • LeASLane.exe (PID: 6500)
      • LeASHive.exe (PID: 1196)
      • AmcacheParser.exe (PID: 8520)
      • pwsh.exe (PID: 8772)
      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)

    • The sample compiled with chinese language support

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • lsfinstall.exe (PID: 4696)
      • 帝王霸业.exe (PID: 2812)

    • Creates files in the program directory

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • powershell.exe (PID: 1272)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • LenovoServiceAS.exe (PID: 3828)
      • LeASPac.exe (PID: 7520)
      • LockScreenMain.exe (PID: 7548)
      • LeAppOM.exe (PID: 6228)
      • LockScreenAssist.exe (PID: 7956)
      • crashpad_handler.exe (PID: 6892)
      • LenovoAppStore.exe (PID: 5796)
      • LenovoAppStore.exe (PID: 5528)
      • LenovoAppStore.exe (PID: 5124)
      • LeAppStoreTray.exe (PID: 6068)
      • LeASHive.exe (PID: 1196)
      • crashpad_handler.exe (PID: 8288)
      • powershell.exe (PID: 7512)
      • AmcacheParser.exe (PID: 8520)

    • Reads the machine GUID from the registry

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LISFService.exe (PID: 2084)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LISFProt.exe (PID: 240)
      • LISFProt.exe (PID: 132)
      • LeASPac.exe (PID: 6228)
      • LenovoServiceAS.exe (PID: 4272)
      • LeASPac.exe (PID: 7520)
      • LockScreenMain.exe (PID: 7548)
      • LockScreenMain.exe (PID: 7596)
      • LeAppOM.exe (PID: 6228)
      • LeASPac.exe (PID: 7152)
      • LeASLane.exe (PID: 6500)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)
      • AmcacheParser.exe (PID: 8520)

    • Checks proxy server information

      • Store-ind-10002.exe (PID: 7020)
      • slui.exe (PID: 5116)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LeASPac.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LeASPac.exe (PID: 7152)
      • LeAppOM.exe (PID: 6228)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)
      • LeASLane.exe (PID: 6500)

    • Reads CPU info

      • Store-ind-10002.exe (PID: 7020)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LeASPac.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LeASPac.exe (PID: 7152)
      • LeAppOM.exe (PID: 6228)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)
      • LeASLane.exe (PID: 6500)

    • Reads Environment values

      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • Store-ind-10002.exe (PID: 7020)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LeASPac.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LeASPac.exe (PID: 7152)
      • LeAppOM.exe (PID: 6228)
      • LenovoAppStore.exe (PID: 5796)
      • LeASLane.exe (PID: 6500)
      • LeASHive.exe (PID: 1196)

    • Checks supported languages

      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • Store-ind-10002.exe (PID: 7020)
      • LISFService.exe (PID: 2084)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LISFProt.exe (PID: 240)
      • LISFProt.exe (PID: 132)
      • LenovoInternetSoftwareFramework.exe (PID: 3768)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • chcp.com (PID: 7144)
      • chcp.com (PID: 8028)
      • chcp.com (PID: 5528)
      • chcp.com (PID: 684)
      • chcp.com (PID: 6184)
      • chcp.com (PID: 6028)
      • chcp.com (PID: 8048)
      • chcp.com (PID: 5232)
      • chcp.com (PID: 6488)
      • chcp.com (PID: 5680)
      • LenovoServiceAS.exe (PID: 7836)
      • LenovoServiceAS.exe (PID: 4272)
      • LeASPac.exe (PID: 7520)
      • Lsf.exe (PID: 5188)
      • Lsf.exe (PID: 4180)
      • LenovoServiceAS.exe (PID: 3828)
      • LockScreenMain.exe (PID: 7548)
      • LeAppOM.exe (PID: 6228)
      • LeASPac.exe (PID: 7152)
      • LockScreenMain.exe (PID: 7596)
      • LockScreenAssist.exe (PID: 7956)
      • crashpad_handler.exe (PID: 6892)
      • LenovoAppStore.exe (PID: 4452)
      • LenovoAppStore.exe (PID: 6184)
      • LenovoAppStore.exe (PID: 5528)
      • LeAppStoreTray.exe (PID: 6068)
      • LeASLane.exe (PID: 6500)
      • LenovoAppStore.exe (PID: 5124)
      • LenovoAppStore.exe (PID: 5796)
      • LeASHive.exe (PID: 1196)
      • AmcacheParser.exe (PID: 8520)
      • crashpad_handler.exe (PID: 8288)
      • 帝王霸业.exe (PID: 2812)
      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)
      • pwsh.exe (PID: 8772)

    • Process checks computer location settings

      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • Store-ind-10002.exe (PID: 7020)
      • LISFInstall.exe (PID: 7404)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • LeASPac.exe (PID: 7520)
      • LeAppOM.exe (PID: 6228)
      • LeASPac.exe (PID: 7152)
      • LenovoAppStore.exe (PID: 5796)
      • LenovoAppStore.exe (PID: 5124)
      • LeASLane.exe (PID: 6500)
      • LeASHive.exe (PID: 1196)
      • pwsh.exe (PID: 8772)

    • Reads product name

      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASLane.exe (PID: 8040)
      • Store-ind-10002.exe (PID: 7020)
      • LenovoInternetSoftwareFramework.exe (PID: 2664)
      • LeASPac.exe (PID: 6228)
      • LeASPac.exe (PID: 7520)
      • LeASPac.exe (PID: 7152)
      • LeAppOM.exe (PID: 6228)
      • LenovoAppStore.exe (PID: 5796)
      • LeASLane.exe (PID: 6500)
      • LeASHive.exe (PID: 1196)

    • Create files in a temporary directory

      • LeASLane.exe (PID: 8040)
      • LISFInstall.exe (PID: 7404)
      • LenovoAppStoreInstall.exe (PID: 8160)
      • LeASPac.exe (PID: 6228)
      • lsfinstall.exe (PID: 4696)
      • Lsf.exe (PID: 5188)
      • LeAppOM.exe (PID: 6228)
      • Store-ind-10002.exe (PID: 1040)
      • LenovoAppStore.exe (PID: 5796)
      • LeAppStoreTray.exe (PID: 6068)
      • LeASHive.exe (PID: 1196)
      • 帝王霸业.exe (PID: 2812)
      • ssjj2-lenovo-20240806_8_32768_3276800095.exe (PID: 7008)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 4304)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 7936)
      • cmd.exe (PID: 6516)
      • cmd.exe (PID: 6252)

    • Process checks whether UAC notifications are on

      • LockScreenMain.exe (PID: 7548)

    • Reads the time zone

      • LeAppOM.exe (PID: 6228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
299
Monitored processes
146
Malicious processes
12
Suspicious processes
6

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs rundll32.exe no specs slui.exe cmd.exe no specs conhost.exe no specs certutil.exe no specs chrome.exe store-ind-10002.exe no specs store-ind-10002.exe locator.exe no specs wmiapsrv.exe no specs werfault.exe no specs store-ind-10002.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lenovoappstoreinstall.exe powershell.exe no specs conhost.exe no specs leaslane.exe lisfinstall.exe lisfservice.exe lenovointernetsoftwareframework.exe lisfprot.exe lisfprot.exe no specs lenovointernetsoftwareframework.exe no specs leaspac.exe lsfinstall.exe cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs lsf.exe no specs lsf.exe no specs lenovoserviceas.exe no specs lenovoserviceas.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs lenovoserviceas.exe no specs leaspac.exe lockscreenmain.exe leappom.exe leaspac.exe regsvr32.exe no specs lockscreenmain.exe no specs regsvr32.exe no specs lockscreenassist.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs icacls.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs lenovoappstore.exe crashpad_handler.exe no specs lenovoappstore.exe no specs lenovoappstore.exe no specs lenovoappstore.exe lenovoappstore.exe no specs leappstoretray.exe no specs leaslane.exe no specs powershell.exe no specs conhost.exe no specs leashive.exe crashpad_handler.exe no specs powershell.exe no specs conhost.exe no specs amcacheparser.exe no specs conhost.exe no specs chrome.exe no specs ssjj2-lenovo-20240806_8_32768_3276800095.exe pwsh.exe conhost.exe no specs 帝王霸业.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Lenovo\LenovoInternetSoftwareFramework\LISFProt.exe"C:\Program Files (x86)\Lenovo\LenovoInternetSoftwareFramework\LISFProt.exe—LISFService.exe
User:
admin
Company:
Lenovo
Integrity Level:
HIGH
Description:
LISFProt
Exit code:
0
Version:
1.0.2.12021
Modules
Images
c:\program files (x86)\lenovo\lenovointernetsoftwareframework\lisfprot.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
240"C:\Program Files (x86)\Lenovo\LenovoInternetSoftwareFramework\LISFProt.exe" C:\Program Files (x86)\Lenovo\LenovoInternetSoftwareFramework\LISFProt.exe
LISFInstall.exe
User:
admin
Company:
Lenovo
Integrity Level:
HIGH
Description:
LISFProt
Exit code:
0
Version:
1.0.2.12021
Modules
Images
c:\program files (x86)\lenovo\lenovointernetsoftwareframework\lisfprot.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
240"C:\Windows\System32\cmd.exe" /c icacls.exe C:\WINDOWS\Web\Screen /setowner "NT SERVICE\TrustedInstaller" /T && icacls.exe C:\WINDOWS\Web /restore 07F3976E-47D9-4138-A1AD-834BBEA451CEC:\Windows\System32\cmd.exe—LockScreenMain.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6032 --field-trial-handle=1904,i,5889786100608373525,14084792955344040536,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
632C:\WINDOWS\system32\wbem\WmiApSrv.exeC:\Windows\System32\wbem\WmiApSrv.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Performance Reverse Adapter
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll
684chcp 437C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
840"regsvr32.exe" /s "C:\Program Files (x86)\Lenovo\LeAppStore\AppStore\AppStoreExt64Ex.dll"C:\Windows\System32\regsvr32.exe—Store-ind-10002.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
920certutil -hashfile Store-ind-10002.exeC:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
928"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6504 --field-trial-handle=1904,i,5889786100608373525,14084792955344040536,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
928schtasks /delete /tn "Lenovo LSF Task 7" /FC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
92 445
Read events
92 028
Write events
371
Delete events
46

Modification events

(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3332) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(5084) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
010000000000000051E0A1557398DB01
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C1I
Value:
1
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C2I
Value:
1
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C7I
Value:
1
(PID) Process:(3332) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Common\Rlz\Events\C
Operation:writeName:C1S
Value:
1
Executable files
190
Suspicious files
837
Text files
191
Unknown types
0

Dropped files

PID
Process
Filename
Type
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10d95a.TMP —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10d95a.TMP —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10d95a.TMP —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10d95a.TMP —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10d95a.TMP —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
3332chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
402
DNS requests
148
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7400
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
2384
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7712
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7400
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
7400
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7400
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
7400
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/mfnf4w4aaa2rporuqgtjqv35v4_4.10.2891.0/oimompecagnajdejgnnjijobebaeigek_4.10.2891.0_win64_acwxtxt2znguar3w2o252umtomsq.crx3
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3332
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7248
chrome.exe
142.250.153.84:443
accounts.google.com
GOOGLE
US
whitelisted
7248
chrome.exe
39.106.134.75:443
lenovomm.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.42
  • 2.16.164.43
  • 2.16.164.49
  • 2.16.164.9
  • 2.16.164.72
  • 2.16.164.81
  • 2.16.164.18
  • 2.16.164.24
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
lenovomm.com
  • 39.106.134.75
unknown
accounts.google.com
  • 142.250.153.84
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.67
  • 20.190.160.131
  • 20.190.160.3
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.159.128
  • 20.190.159.129
  • 20.190.159.131
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.129
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
s1.lenovomm.cn
  • 154.85.69.14
  • 154.85.69.12
unknown
fsr.lenovomm.com
  • 84.252.116.8
unknown

Threats

PID
Process
Class
Message
8772
pwsh.exe
Not Suspicious Traffic
INFO [ANY.RUN] Azure Front Door domain observed in TLS SNI ( .azurefd .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://lenovomm.com/