File name:

4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778

Full analysis: https://app.any.run/tasks/7f4e8f06-2f8f-4e68-aff4-0c1f65ff04e9
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:50:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

0067679C7033139BCBB273840494B324

SHA1:

24603D660221D10F0BFE178A801C3DA181F0D07D

SHA256:

4A0E7565DB16ED833A083BC9927F032BE5E6918EED712982CD76E87E99510778

SSDEEP:

12288:j2mm3Kx2gyo0uHG7o97jOvbuviyWtmuHM6g10QWND6NJHRxDzZ9mH5X:i93Kx2gyo0uHG7o9IyWtRHM6giDmDzG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 2136)
      • net.exe (PID: 1180)
      • net.exe (PID: 7628)
      • net.exe (PID: 4988)
      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)
      • net.exe (PID: 7484)
      • net.exe (PID: 8000)
      • net.exe (PID: 7548)
      • net.exe (PID: 8140)
      • net.exe (PID: 8212)
      • net.exe (PID: 8416)
      • net.exe (PID: 8324)
      • net.exe (PID: 8508)
      • net.exe (PID: 8760)
      • net.exe (PID: 8228)
      • net.exe (PID: 8388)
      • net.exe (PID: 8456)
      • net.exe (PID: 8540)
      • net.exe (PID: 9196)
      • net.exe (PID: 8904)
      • net.exe (PID: 8964)
      • net.exe (PID: 9040)
      • net.exe (PID: 6480)
      • net.exe (PID: 8600)
      • net.exe (PID: 8700)
      • net.exe (PID: 8808)
      • net.exe (PID: 9004)
      • net.exe (PID: 8916)
      • net.exe (PID: 9088)
      • net.exe (PID: 9188)
      • net.exe (PID: 8664)
      • net.exe (PID: 8900)
      • net.exe (PID: 8716)
      • net.exe (PID: 8940)
      • net.exe (PID: 9208)
      • net.exe (PID: 9212)
      • net.exe (PID: 8844)
      • net.exe (PID: 8440)
      • net.exe (PID: 5116)
      • net.exe (PID: 8520)
      • net.exe (PID: 7188)
      • net.exe (PID: 8372)
      • net.exe (PID: 8436)
      • net.exe (PID: 8408)
      • net.exe (PID: 8516)
      • net.exe (PID: 8924)
      • net.exe (PID: 6964)
      • net.exe (PID: 8076)
      • net.exe (PID: 8568)
      • net.exe (PID: 8528)
      • net.exe (PID: 8712)
      • net.exe (PID: 8992)
      • net.exe (PID: 8952)
      • net.exe (PID: 9144)
      • net.exe (PID: 8368)
      • net.exe (PID: 4408)
      • net.exe (PID: 8836)
      • net.exe (PID: 8848)
      • net.exe (PID: 9020)
      • net.exe (PID: 7980)
      • net.exe (PID: 8340)
      • net.exe (PID: 8272)
      • net.exe (PID: 8572)
      • net.exe (PID: 1012)
      • net.exe (PID: 8480)
      • net.exe (PID: 8852)
      • net.exe (PID: 4112)
      • net.exe (PID: 1040)
      • net.exe (PID: 7732)
      • net.exe (PID: 8564)
      • net.exe (PID: 8424)
      • net.exe (PID: 8648)
      • net.exe (PID: 8708)
      • net.exe (PID: 8984)
      • net.exe (PID: 6080)
      • net.exe (PID: 9016)
      • net.exe (PID: 8264)
      • net.exe (PID: 1568)
      • net.exe (PID: 8364)
      • net.exe (PID: 8256)
      • net.exe (PID: 632)
      • net.exe (PID: 1240)
      • net.exe (PID: 9116)
      • net.exe (PID: 8580)
      • net.exe (PID: 8800)
      • net.exe (PID: 2552)
      • net.exe (PID: 8692)
      • net.exe (PID: 8892)
      • net.exe (PID: 9068)
      • net.exe (PID: 8300)
      • net.exe (PID: 9136)
      • net.exe (PID: 3888)
      • net.exe (PID: 8260)
      • net.exe (PID: 8728)
      • net.exe (PID: 9108)

    • XORed URL has been found (YARA)

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 9784)

    • Uses TASKKILL.EXE to kill antiviruses

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • MEDUSA note has been found

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • MEDUSA has been detected

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • RANSOMWARE has been detected

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • Uses TASKKILL.EXE to kill Office Apps

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • Uses TASKKILL.EXE to kill Browsers

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

    • Creates file in the systems drive root

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)

  • INFO

    • Checks supported languages

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 4776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(4776) 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
Decrypted-URLs (7)http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/800864f3ec6807f3942442f080b719f3
http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/800864f3ec6807f3942442f080b719f3
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:25 06:40:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 193024
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
510
Monitored processes
378
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs sppextcomobj.exe no specs slui.exe net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\net1 stop "MSSQL$PROD" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
632net stop "MSSQL$SOPHOS" /yC:\Windows\SysWOW64\net.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668taskkill /F /IM thunderbird.exe /TC:\Windows\SysWOW64\taskkill.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720taskkill /F /IM ocomm.exe /TC:\Windows\SysWOW64\taskkill.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
736C:\WINDOWS\system32\net1 stop "NetMsmqActivator" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
856C:\WINDOWS\system32\net1 stop "wbengine" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
1012net stop "wbengine" /yC:\Windows\SysWOW64\net.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 741
Read events
7 741
Write events
0
Delete events
0

Modification events

No data
Executable files
28
Suspicious files
4 643
Text files
855
Unknown types
0

Dropped files

PID
Process
Filename
Type
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:1C4DA1B118F0E510C04A0D263739E8C1
SHA256:FE1E3EDEB3ADCDF4312C8F1836DBD626B55F5DD54D6704C80D89AA3BA58BA5C0
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:7A4901702A604CBE487210EA8BDD967B
SHA256:EE46BB9E755D0EC525E9D0D146A9A49449B919B26AE96ABFF94AD3D39CB8CAEE
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:A9B61C83CC4C290A4D42F8F52F8DF0E5
SHA256:E584ED7ABE57FD917823807440924F47D194368C60CFE8D262E505D86B4D0CE0
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:1C4DA1B118F0E510C04A0D263739E8C1
SHA256:FE1E3EDEB3ADCDF4312C8F1836DBD626B55F5DD54D6704C80D89AA3BA58BA5C0
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:D230AEA097E313A391AF07E7262BF055
SHA256:326CDFBF788FBA51FA91D85A6A626BCB6167BBF7846368DD7F1116B75A08D8FB
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:0E485D3C082A1739D8B671F31076D2E0
SHA256:90DAFA9A1B9A922DE5A1AD33FFF624126BE2DB9E65863B9DEC683F1DBA29B5BD
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:3674252ADD72EC8006FE3AE8F5C6644B
SHA256:3A63193BA351AEFB613BC34105E26BD99112FB5A72DA4A514C5663D2AC3493B3
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\ProgramData\Adobe\!!!READ_ME_MEDUSA!!!.txttext
MD5:7A4901702A604CBE487210EA8BDD967B
SHA256:EE46BB9E755D0EC525E9D0D146A9A49449B919B26AE96ABFF94AD3D39CB8CAEE
47764a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.manbinary
MD5:DB5E18C70C54F8DCD39B49EE7381FF55
SHA256:7A2E7AF920F99C4F5CE810FCB0DA0AF5449C92EBA0E8F0338BC77CAA1B327D18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
10064
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
10064
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5112
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.2
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.4
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778