File name:

19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b

Full analysis: https://app.any.run/tasks/3f56cddf-4b5e-46a3-b60c-7a254e6da205
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:55:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

10911494FA52DAEE0279972F91FDED01

SHA1:

FB219DB11F700FE4BE1FB63226E68830E4F1B57C

SHA256:

19B65EF538144E873271F547807830A5BA31FE215F2FE7ADE51A38047A80834B

SSDEEP:

12288:oR9nPKNcAro09cG7YfbgwS6AvnnWKkz5BJYbutrqUd0qcRHgomH5:E9PKNcAro09cG7Yf+nWKa5BJY3USg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 7216)
      • net.exe (PID: 7404)
      • net.exe (PID: 8100)
      • net.exe (PID: 5392)
      • net.exe (PID: 7460)
      • net.exe (PID: 7820)
      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)
      • net.exe (PID: 8180)
      • net.exe (PID: 7196)
      • net.exe (PID: 6240)
      • net.exe (PID: 7360)
      • net.exe (PID: 7928)
      • net.exe (PID: 7208)
      • net.exe (PID: 4040)
      • net.exe (PID: 5176)
      • net.exe (PID: 1052)
      • net.exe (PID: 1660)
      • net.exe (PID: 7156)
      • net.exe (PID: 7536)
      • net.exe (PID: 6112)
      • net.exe (PID: 5384)
      • net.exe (PID: 7876)
      • net.exe (PID: 7496)
      • net.exe (PID: 8164)
      • net.exe (PID: 4000)
      • net.exe (PID: 2088)
      • net.exe (PID: 4120)
      • net.exe (PID: 3888)
      • net.exe (PID: 7528)
      • net.exe (PID: 7900)
      • net.exe (PID: 7340)
      • net.exe (PID: 864)
      • net.exe (PID: 7272)
      • net.exe (PID: 7476)
      • net.exe (PID: 4164)
      • net.exe (PID: 2268)
      • net.exe (PID: 7052)
      • net.exe (PID: 7540)
      • net.exe (PID: 2420)
      • net.exe (PID: 7980)
      • net.exe (PID: 8060)
      • net.exe (PID: 1388)
      • net.exe (PID: 4464)
      • net.exe (PID: 7300)
      • net.exe (PID: 2240)
      • net.exe (PID: 7616)
      • net.exe (PID: 8476)
      • net.exe (PID: 8760)
      • net.exe (PID: 8672)
      • net.exe (PID: 9116)
      • net.exe (PID: 9028)
      • net.exe (PID: 8848)
      • net.exe (PID: 8932)
      • net.exe (PID: 8380)
      • net.exe (PID: 8284)
      • net.exe (PID: 8600)
      • net.exe (PID: 8420)
      • net.exe (PID: 8556)
      • net.exe (PID: 4424)
      • net.exe (PID: 7500)
      • net.exe (PID: 8216)
      • net.exe (PID: 8304)
      • net.exe (PID: 8392)
      • net.exe (PID: 8564)
      • net.exe (PID: 9204)
      • net.exe (PID: 8888)
      • net.exe (PID: 6244)
      • net.exe (PID: 8244)
      • net.exe (PID: 9132)
      • net.exe (PID: 8912)
      • net.exe (PID: 8320)
      • net.exe (PID: 6080)
      • net.exe (PID: 8516)
      • net.exe (PID: 5964)
      • net.exe (PID: 8656)
      • net.exe (PID: 8780)
      • net.exe (PID: 3008)
      • net.exe (PID: 9008)
      • net.exe (PID: 8688)
      • net.exe (PID: 8828)
      • net.exe (PID: 9052)
      • net.exe (PID: 8584)
      • net.exe (PID: 6040)
      • net.exe (PID: 8628)
      • net.exe (PID: 8896)
      • net.exe (PID: 4008)
      • net.exe (PID: 9080)
      • net.exe (PID: 9152)
      • net.exe (PID: 8372)
      • net.exe (PID: 1328)
      • net.exe (PID: 8836)
      • net.exe (PID: 8984)
      • net.exe (PID: 9176)
      • net.exe (PID: 736)
      • net.exe (PID: 8460)
      • net.exe (PID: 8544)
      • net.exe (PID: 8356)
      • net.exe (PID: 8680)
      • net.exe (PID: 8812)
      • net.exe (PID: 8512)
      • net.exe (PID: 9128)
      • net.exe (PID: 9196)
      • net.exe (PID: 8316)
      • net.exe (PID: 8756)
      • net.exe (PID: 8924)
      • net.exe (PID: 4736)
      • net.exe (PID: 8268)
      • net.exe (PID: 9040)
      • net.exe (PID: 6816)
      • net.exe (PID: 8440)
      • net.exe (PID: 2772)
      • net.exe (PID: 8844)
      • net.exe (PID: 7152)
      • net.exe (PID: 9192)
      • net.exe (PID: 856)
      • net.exe (PID: 8488)
      • net.exe (PID: 1764)
      • net.exe (PID: 8804)

    • XORed URL has been found (YARA)

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • RANSOMWARE has been detected

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 9720)

    • Uses TASKKILL.EXE to kill antiviruses

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • MEDUSA has been detected

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • MEDUSA note has been found

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • Uses TASKKILL.EXE to kill Office Apps

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

    • Uses TASKKILL.EXE to kill Browsers

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)

  • INFO

    • Checks supported languages

      • 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe (PID: 4244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(4244) 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe
Decrypted-URLs (6)http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/48b8b4607e018e2c9658993de90f49e0
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:20 07:01:33+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
576
Monitored processes
447
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs sppextcomobj.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736net stop "VeeamDeploySvc" /yC:\Windows\SysWOW64\net.exe—19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856net stop "kavfsslp" /yC:\Windows\SysWOW64\net.exe—19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864net stop "SAVAdminService" /yC:\Windows\SysWOW64\net.exe—19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904C:\WINDOWS\system32\net1 stop "klnagent" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1012taskkill /F /IM oracle.exe /TC:\Windows\SysWOW64\taskkill.exe—19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
8 166
Read events
8 166
Write events
0
Delete events
0

Modification events

No data
Executable files
30
Suspicious files
4 561
Text files
772
Unknown types
0

Dropped files

PID
Process
Filename
Type
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:7A82EFB14DEF79048A3DB43B0FD21DDF
SHA256:7B885D7A0E7A6D800955DBA69162AFA412A1B0ADE8C3BF1C80A124FAAFBA69A6
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:137AAA9EB198ECE886A7AF4C99F90C7F
SHA256:FD65AF872520C6E463898C0899A24FADFEF0215BC77EC6E3DDBDDC14CEB3CB20
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:87541D1FDAEBB6255BDBC2607BD6B091
SHA256:293A243550FDB6D67F2AFD68E8011DEA11FDCC5DACEF0C7B9B1C2C3990C2790C
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:45A4DD237CF6FB55AE76956AC5ACF6AE
SHA256:15F7D49D2DA95B646E30954DD00F9E215B79CD2247F7E24E6E2C9AF22310D051
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xmlbinary
MD5:C707717592B2AC14DDC4EB82D05D678C
SHA256:7765AC23E2577EA4039FB5CF6B0552BA31F22807791515E75110FA5F218AC854
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xmlbinary
MD5:8255F637534EDFE922164DBEA3678411
SHA256:E78D03D17B4E783B64EB1A2AC9C48B00A9A575C8418BB3CD6C5A16E15E6C1969
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:DC5993B45B7D46A3D13705774F1539FD
SHA256:9D2A1F9D6D86235E40554ED5226813DF495D15855431E35F206C6192DF3C912B
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xmlbinary
MD5:D786273720AA1DE7421BA83F2101C8E9
SHA256:BD5BEA9AED98CC8D01C105A7190CF284F9B5D59A12D148033274B18FBE7E6EE1
424419b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:3678CA02FF279205D55B75328A91A16D
SHA256:2AFEA4C4934A349A1C17637BB67E5F3BDF9DAA81A763091E511D6657D41EE39C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
9652
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
9652
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
9652
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.128
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
19b65ef538144e873271f547807830a5ba31fe215f2fe7ade51a38047a80834b