File name:

0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460

Full analysis: https://app.any.run/tasks/d4e3f2b6-45f5-4963-914e-4905fc97b908
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:59:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

4FE99E5DC101170750D8ECE6EA066155

SHA1:

F4E5E77FB9AECA818C9C087C481651C183B8F957

SHA256:

0382F4930CB892B43C80EF147AD617C332A7C2E298502EF0E6663B2B48319460

SSDEEP:

24576:plJAUdDsoVkcG7/YKbWQOogOYd4+wgGa0Y:plJAUdDsoVkcG7/YKbWQhgOO4+wgGlY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)
      • net.exe (PID: 7244)
      • net.exe (PID: 496)
      • net.exe (PID: 7328)
      • net.exe (PID: 7416)
      • net.exe (PID: 7592)
      • net.exe (PID: 7504)
      • net.exe (PID: 7680)
      • net.exe (PID: 7768)
      • net.exe (PID: 7860)
      • net.exe (PID: 7948)
      • net.exe (PID: 8036)
      • net.exe (PID: 8124)
      • net.exe (PID: 7216)
      • net.exe (PID: 8032)
      • net.exe (PID: 7900)
      • net.exe (PID: 1056)
      • net.exe (PID: 8156)
      • net.exe (PID: 7300)
      • net.exe (PID: 7376)
      • net.exe (PID: 7460)
      • net.exe (PID: 7608)
      • net.exe (PID: 5556)
      • net.exe (PID: 1324)
      • net.exe (PID: 6744)
      • net.exe (PID: 7284)
      • net.exe (PID: 7412)
      • net.exe (PID: 7524)
      • net.exe (PID: 7756)
      • net.exe (PID: 7664)
      • net.exe (PID: 7812)
      • net.exe (PID: 7236)
      • net.exe (PID: 7224)
      • net.exe (PID: 5728)
      • net.exe (PID: 7444)
      • net.exe (PID: 4428)
      • net.exe (PID: 5380)
      • net.exe (PID: 7836)
      • net.exe (PID: 7752)
      • net.exe (PID: 8072)
      • net.exe (PID: 5064)
      • net.exe (PID: 8160)
      • net.exe (PID: 7204)
      • net.exe (PID: 7484)
      • net.exe (PID: 5800)
      • net.exe (PID: 1164)
      • net.exe (PID: 7740)
      • net.exe (PID: 7852)
      • net.exe (PID: 8000)
      • net.exe (PID: 8116)
      • net.exe (PID: 7884)
      • net.exe (PID: 8020)
      • net.exe (PID: 8100)
      • net.exe (PID: 8088)
      • net.exe (PID: 7820)
      • net.exe (PID: 7260)
      • net.exe (PID: 7488)
      • net.exe (PID: 6272)
      • net.exe (PID: 7876)
      • net.exe (PID: 7344)
      • net.exe (PID: 7908)
      • net.exe (PID: 1228)
      • net.exe (PID: 5124)
      • net.exe (PID: 8060)
      • net.exe (PID: 7456)
      • net.exe (PID: 7840)
      • net.exe (PID: 7200)
      • net.exe (PID: 7828)
      • net.exe (PID: 7800)
      • net.exe (PID: 8028)
      • net.exe (PID: 7872)
      • net.exe (PID: 7348)
      • net.exe (PID: 7372)
      • net.exe (PID: 5508)
      • net.exe (PID: 5528)
      • net.exe (PID: 680)
      • net.exe (PID: 6132)
      • net.exe (PID: 7452)
      • net.exe (PID: 7308)
      • net.exe (PID: 7636)
      • net.exe (PID: 5576)
      • net.exe (PID: 4976)
      • net.exe (PID: 7944)
      • net.exe (PID: 7368)
      • net.exe (PID: 7612)
      • net.exe (PID: 6028)
      • net.exe (PID: 7272)
      • net.exe (PID: 7704)
      • net.exe (PID: 7320)
      • net.exe (PID: 7392)
      • net.exe (PID: 7492)
      • net.exe (PID: 3888)
      • net.exe (PID: 920)
      • net.exe (PID: 5596)
      • net.exe (PID: 1912)
      • net.exe (PID: 4488)
      • net.exe (PID: 7776)
      • net.exe (PID: 6728)
      • net.exe (PID: 8076)
      • net.exe (PID: 4268)
      • net.exe (PID: 5112)
      • net.exe (PID: 7988)
      • net.exe (PID: 8204)
      • net.exe (PID: 8384)
      • net.exe (PID: 8472)
      • net.exe (PID: 8560)
      • net.exe (PID: 8648)
      • net.exe (PID: 8736)
      • net.exe (PID: 8288)
      • net.exe (PID: 8824)
      • net.exe (PID: 8908)
      • net.exe (PID: 8768)
      • net.exe (PID: 8936)
      • net.exe (PID: 9012)
      • net.exe (PID: 5892)
      • net.exe (PID: 8232)
      • net.exe (PID: 8340)
      • net.exe (PID: 9000)
      • net.exe (PID: 9088)
      • net.exe (PID: 9176)
      • net.exe (PID: 7340)
      • net.exe (PID: 8308)
      • net.exe (PID: 8396)
      • net.exe (PID: 8608)
      • net.exe (PID: 8536)
      • net.exe (PID: 8728)
      • net.exe (PID: 9156)
      • net.exe (PID: 8940)
      • net.exe (PID: 9028)
      • net.exe (PID: 8524)
      • net.exe (PID: 8048)
      • net.exe (PID: 8304)
      • net.exe (PID: 8752)
      • net.exe (PID: 8668)
      • net.exe (PID: 9136)
      • net.exe (PID: 8200)
      • net.exe (PID: 8344)
      • net.exe (PID: 8492)
      • net.exe (PID: 8548)
      • net.exe (PID: 8640)
      • net.exe (PID: 8780)
      • net.exe (PID: 8856)
      • net.exe (PID: 7932)
      • net.exe (PID: 8892)
      • net.exe (PID: 4696)
      • net.exe (PID: 8644)
      • net.exe (PID: 8540)
      • net.exe (PID: 9128)
      • net.exe (PID: 9168)
      • net.exe (PID: 8428)
      • net.exe (PID: 8840)
      • net.exe (PID: 8900)
      • net.exe (PID: 8976)
      • net.exe (PID: 8412)
      • net.exe (PID: 8712)
      • net.exe (PID: 8700)
      • net.exe (PID: 9060)
      • net.exe (PID: 8240)
      • net.exe (PID: 8636)
      • net.exe (PID: 9020)
      • net.exe (PID: 8248)
      • net.exe (PID: 8552)
      • net.exe (PID: 8956)
      • net.exe (PID: 8760)
      • net.exe (PID: 8324)
      • net.exe (PID: 8676)
      • net.exe (PID: 8904)
      • net.exe (PID: 8680)
      • net.exe (PID: 8228)
      • net.exe (PID: 9160)
      • net.exe (PID: 7084)
      • net.exe (PID: 9100)
      • net.exe (PID: 9140)
      • net.exe (PID: 8920)
      • net.exe (PID: 8724)
      • net.exe (PID: 2152)
      • net.exe (PID: 9048)
      • net.exe (PID: 8408)
      • net.exe (PID: 8372)
      • net.exe (PID: 8424)

    • XORed URL has been found (YARA)

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Uses TASKKILL.EXE to kill antiviruses

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 8592)

    • MEDUSA note has been found

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • MEDUSA has been detected

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • RANSOMWARE has been detected

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Uses TASKKILL.EXE to kill process

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Uses TASKKILL.EXE to kill Office Apps

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

    • Uses TASKKILL.EXE to kill Browsers

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)

  • INFO

    • Checks supported languages

      • 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe (PID: 1676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(1676) 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe
Decrypted-URLs (6)http://dsuacxnagoa4eqcvyipogykrgchdgwoyy2gjdgwv6ty7n3jr4rdxdhid.onion/1c16e8393a7650270e9141cc077e037d
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/1c16e8393a7650270e9141cc077e037d
http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:15 20:31:59+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 191488
UninitializedDataSize: -
EntryPoint: 0x37c68
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
761
Monitored processes
632
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sppextcomobj.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs slui.exe net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496net stop "Acronis VSS Provider" /yC:\Windows\SysWOW64\net.exe—0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660C:\WINDOWS\system32\net1 stop "MSSQLFDLauncher$TPS" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
680net stop "MSSQLFDLauncher$TPSAMA" /yC:\Windows\SysWOW64\net.exe—0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896C:\WINDOWS\system32\net1 stop "SamSs" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904C:\WINDOWS\system32\net1 stop "MSOLAP$TPS" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920net stop "sacsvr" /yC:\Windows\SysWOW64\net.exe—0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
10 557
Read events
10 557
Write events
0
Delete events
0

Modification events

No data
Executable files
24
Suspicious files
4 568
Text files
757
Unknown types
0

Dropped files

PID
Process
Filename
Type
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:166C58CDDD1577C7947255C67922E8BF
SHA256:359650D9180FE5C07EEEE1C07069D6CEE032C48158093EDA4BDCB3DE9041713A
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:11EC3EB5507B6249844DB11656D7F021
SHA256:44ADF6180A9670E63C5DF3A00E21B10B3D68DA57AEA4D7138C073FC3040503A9
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:166C58CDDD1577C7947255C67922E8BF
SHA256:359650D9180FE5C07EEEE1C07069D6CEE032C48158093EDA4BDCB3DE9041713A
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:D4EE76408EF0EB9B020DBA255FE9AABA
SHA256:FA27A5E3C2FE78723AE862B0D0702B592D6CB527E3005395DACB8D85379D9EF4
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:7DCE1BD1490B7FB34734CEB188619354
SHA256:BB51721C441629D47042AAADF1CEE38D6ADF6AA6559ED8417E5FC8013D890021
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:E39F36905FFBAEFC02F5F3A2A91AB081
SHA256:A17CEAE6B9AAEDDE6D583DA33E0EFAA75D9473B5CA6CB2270BA868A95C1C8CC0
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:4799B9F24EDA3C2560A6EB4393EB6ECD
SHA256:F00C78AE89E15FC9ECEB5C8FA3E29A3689CB842EB90E7D004A684B70EE712B43
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\ProgramData\Adobe\!!!READ_ME_MEDUSA!!!.txttext
MD5:7DCE1BD1490B7FB34734CEB188619354
SHA256:BB51721C441629D47042AAADF1CEE38D6ADF6AA6559ED8417E5FC8013D890021
16760382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:89D8891E00BC914992971FADED035D2A
SHA256:4843F478176FE678D03A7412304EF1A39649ECD5005AFE224D788FD4BF32D941
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.5:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
9360
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9360
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.5:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.5
  • 23.216.77.15
  • 23.216.77.17
  • 23.216.77.12
  • 23.216.77.37
  • 23.216.77.34
  • 23.216.77.7
  • 23.216.77.6
  • 23.216.77.32
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.130
  • 40.126.31.2
  • 20.190.159.129
  • 40.126.31.128
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0382f4930cb892b43c80ef147ad617c332a7c2e298502ef0e6663b2b48319460