File name:

08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7

Full analysis: https://app.any.run/tasks/ce32420b-ea27-47f8-aa99-e46869d89d48
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:55:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

DC344328208C3481587D0AAB1005FCDD

SHA1:

64E6DEC98FCF54AF204E43058C5E3BA3369BCF3B

SHA256:

08B74BB2D6EC9BBDABDD92FB32D8322D2E08B45B0BE069C7429675D33D5060C7

SSDEEP:

12288:qL7fBtttAro09cG7YFbgwS6AvnrWXkuW/MQp0sWdvqNJXRqramH5:YLBtttAro09cG7YF+rWXvW/MQCvbr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)
      • net.exe (PID: 7308)
      • net.exe (PID: 7584)
      • net.exe (PID: 7400)
      • net.exe (PID: 5512)
      • net.exe (PID: 7672)
      • net.exe (PID: 7220)
      • net.exe (PID: 7492)
      • net.exe (PID: 7756)
      • net.exe (PID: 7932)
      • net.exe (PID: 7844)
      • net.exe (PID: 8020)
      • net.exe (PID: 7820)
      • net.exe (PID: 7872)
      • net.exe (PID: 7972)
      • net.exe (PID: 7556)
      • net.exe (PID: 7868)
      • net.exe (PID: 4996)
      • net.exe (PID: 6744)
      • net.exe (PID: 8108)
      • net.exe (PID: 7200)
      • net.exe (PID: 7296)
      • net.exe (PID: 7344)
      • net.exe (PID: 7484)
      • net.exe (PID: 7684)
      • net.exe (PID: 7608)
      • net.exe (PID: 7316)
      • net.exe (PID: 7520)
      • net.exe (PID: 7180)
      • net.exe (PID: 728)
      • net.exe (PID: 1228)
      • net.exe (PID: 7732)
      • net.exe (PID: 7976)
      • net.exe (PID: 5988)
      • net.exe (PID: 6564)
      • net.exe (PID: 7428)
      • net.exe (PID: 7348)
      • net.exe (PID: 6044)
      • net.exe (PID: 5640)
      • net.exe (PID: 7596)
      • net.exe (PID: 7612)
      • net.exe (PID: 8144)
      • net.exe (PID: 4448)
      • net.exe (PID: 7888)
      • net.exe (PID: 7508)
      • net.exe (PID: 8132)
      • net.exe (PID: 8172)
      • net.exe (PID: 7708)
      • net.exe (PID: 6388)
      • net.exe (PID: 4336)
      • net.exe (PID: 7720)
      • net.exe (PID: 7808)
      • net.exe (PID: 7336)
      • net.exe (PID: 7992)
      • net.exe (PID: 7560)
      • net.exe (PID: 7536)
      • net.exe (PID: 8032)
      • net.exe (PID: 1812)
      • net.exe (PID: 1164)
      • net.exe (PID: 7768)
      • net.exe (PID: 6584)
      • net.exe (PID: 6240)
      • net.exe (PID: 8168)
      • net.exe (PID: 8084)
      • net.exe (PID: 2096)
      • net.exe (PID: 7692)
      • net.exe (PID: 8000)
      • net.exe (PID: 3332)
      • net.exe (PID: 7360)
      • net.exe (PID: 8216)
      • net.exe (PID: 7700)
      • net.exe (PID: 8480)
      • net.exe (PID: 8304)
      • net.exe (PID: 8392)
      • net.exe (PID: 8068)
      • net.exe (PID: 1300)
      • net.exe (PID: 7424)
      • net.exe (PID: 7688)
      • net.exe (PID: 3676)
      • net.exe (PID: 8832)
      • net.exe (PID: 8916)
      • net.exe (PID: 8464)
      • net.exe (PID: 9092)
      • net.exe (PID: 9176)
      • net.exe (PID: 8212)
      • net.exe (PID: 8320)
      • net.exe (PID: 8692)
      • net.exe (PID: 8556)
      • net.exe (PID: 8828)
      • net.exe (PID: 9080)
      • net.exe (PID: 9168)
      • net.exe (PID: 8568)
      • net.exe (PID: 8656)
      • net.exe (PID: 8744)
      • net.exe (PID: 9008)
      • net.exe (PID: 8612)
      • net.exe (PID: 8944)
      • net.exe (PID: 7532)
      • net.exe (PID: 8324)
      • net.exe (PID: 8376)
      • net.exe (PID: 8780)
      • net.exe (PID: 8516)
      • net.exe (PID: 8708)
      • net.exe (PID: 8880)
      • net.exe (PID: 8964)
      • net.exe (PID: 9036)
      • net.exe (PID: 9144)
      • net.exe (PID: 8364)
      • net.exe (PID: 8428)
      • net.exe (PID: 8648)
      • net.exe (PID: 8616)
      • net.exe (PID: 8776)
      • net.exe (PID: 8984)
      • net.exe (PID: 9140)
      • net.exe (PID: 8228)
      • net.exe (PID: 8388)
      • net.exe (PID: 8548)
      • net.exe (PID: 8372)
      • net.exe (PID: 8356)
      • net.exe (PID: 8812)
      • net.exe (PID: 8564)
      • net.exe (PID: 9068)
      • net.exe (PID: 8204)
      • net.exe (PID: 8628)
      • net.exe (PID: 8524)
      • net.exe (PID: 9032)
      • net.exe (PID: 8716)
      • net.exe (PID: 8924)
      • net.exe (PID: 9164)
      • net.exe (PID: 8408)
      • net.exe (PID: 9160)
      • net.exe (PID: 8592)
      • net.exe (PID: 8724)
      • net.exe (PID: 8932)
      • net.exe (PID: 8244)
      • net.exe (PID: 8956)
      • net.exe (PID: 8588)
      • net.exe (PID: 2240)
      • net.exe (PID: 7412)
      • net.exe (PID: 8988)
      • net.exe (PID: 8240)
      • net.exe (PID: 8868)
      • net.exe (PID: 8296)
      • net.exe (PID: 8884)
      • net.exe (PID: 8552)
      • net.exe (PID: 8368)
      • net.exe (PID: 8340)
      • net.exe (PID: 8248)

    • XORed URL has been found (YARA)

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • RANSOMWARE has been detected

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • MEDUSA note has been found

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 10148)

    • Uses TASKKILL.EXE to kill antiviruses

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • MEDUSA has been detected

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • Uses TASKKILL.EXE to kill Browsers

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • Uses TASKKILL.EXE to kill Office Apps

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • Creates file in the systems drive root

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)

  • INFO

    • Checks supported languages

      • 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5072) 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe
Decrypted-URLs (8)http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/611ce80c9c802c93bf2107b4c6433e76
http://62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion/
http://cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion/
http://qxssgdmzli5kazyimrz3ktra5knhialjrdf4edxnwqsokgvrwjqu7cqd.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/611ce80c9c802c93bf2107b4c6433e76
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 05:28:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 193024
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
662
Monitored processes
533
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sppextcomobj.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs slui.exe net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728net stop "MSSQL$TPS" /yC:\Windows\SysWOW64\net.exe—08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780C:\WINDOWS\system32\net1 stop "ShMonitor" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
904C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1056C:\WINDOWS\system32\net1 stop "MSSQL$PROFXENGAGEMENT" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1096taskkill /F /IM outlook.exe /TC:\Windows\SysWOW64\taskkill.exe—08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
9 532
Read events
9 532
Write events
0
Delete events
0

Modification events

No data
Executable files
18
Suspicious files
4 644
Text files
854
Unknown types
0

Dropped files

PID
Process
Filename
Type
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:F26E03C0FFF63B16673A0F9DE5E058EE
SHA256:151257488D12EC07F5BEA19F15F0BE3742BEF273AAAA32893911053F2486E8AD
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:513FC3B77F45F48BDA5A7940568B3BE1
SHA256:08AD883FB0309248751360327D5BDA5E30E7ADC468E27CEB61CAFCDC69905343
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xmlbinary
MD5:21EEA23AD8A430073EF5F27F917D9712
SHA256:ADF7D7944A0956639F6E91887E7E54CBC87CDD39CF9BBCBB029A9D89FC5C7362
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:F26E03C0FFF63B16673A0F9DE5E058EE
SHA256:151257488D12EC07F5BEA19F15F0BE3742BEF273AAAA32893911053F2486E8AD
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xmlbinary
MD5:50541FA0274E87AF13721C5B68786201
SHA256:95383C3705BC4E5F75D2A7B815F5E13C2FA05760CE4C70B2E465DB2F1FBD0C1F
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:44CEFC7900383747AEB5974CE797339B
SHA256:FFE16A8FBE64C0EB61799C7050F9BCBEC4C399B0B8CE66A541E19D7D2445211A
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:2A35564F3E217A4DE3AED28774F3E646
SHA256:5A2A8CFD90DA9002CA76BB39E64D87F37CF045BCC5791D7026A464DEA283AB36
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:991A7536DC70B2817AEDA821E12E7955
SHA256:42BB364A2F7F93AC3E547EDA4EB9B1DE71A4F68372B26B6818BBBB5212A5D32A
507208b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:CD7585E578B85F13298BB6F5E9D29B1B
SHA256:8DCB4FB190CDC85068221F631A2AE27AF240B63E6C4911605F76A86D352C3B59
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.43:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
9380
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9380
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.43:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
unknown
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.216.77.43
  • 23.216.77.19
  • 23.216.77.32
  • 23.216.77.25
  • 23.216.77.16
  • 23.216.77.30
  • 23.216.77.22
  • 23.216.77.33
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.66
  • 20.190.160.22
  • 40.126.32.140
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
08b74bb2d6ec9bbdabdd92fb32d8322d2e08b45b0be069c7429675d33d5060c7