File name:

4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe

Full analysis: https://app.any.run/tasks/d31ea4c4-a500-4c98-98ad-d62db4f820f6
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:49:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

0067679C7033139BCBB273840494B324

SHA1:

24603D660221D10F0BFE178A801C3DA181F0D07D

SHA256:

4A0E7565DB16ED833A083BC9927F032BE5E6918EED712982CD76E87E99510778

SSDEEP:

12288:j2mm3Kx2gyo0uHG7o97jOvbuviyWtmuHM6g10QWND6NJHRxDzZ9mH5X:i93Kx2gyo0uHG7o9IyWtRHM6giDmDzG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)
      • net.exe (PID: 6156)
      • net.exe (PID: 1228)
      • net.exe (PID: 6652)
      • net.exe (PID: 8132)
      • net.exe (PID: 7260)
      • net.exe (PID: 1672)
      • net.exe (PID: 7460)
      • net.exe (PID: 3020)
      • net.exe (PID: 7708)
      • net.exe (PID: 7896)
      • net.exe (PID: 6644)
      • net.exe (PID: 8024)
      • net.exe (PID: 7320)
      • net.exe (PID: 7508)
      • net.exe (PID: 7828)
      • net.exe (PID: 8088)
      • net.exe (PID: 7440)
      • net.exe (PID: 7644)
      • net.exe (PID: 2088)
      • net.exe (PID: 7780)
      • net.exe (PID: 7904)
      • net.exe (PID: 7528)
      • net.exe (PID: 7196)
      • net.exe (PID: 8000)
      • net.exe (PID: 7964)
      • net.exe (PID: 7688)
      • net.exe (PID: 7352)
      • net.exe (PID: 7396)
      • net.exe (PID: 7048)
      • net.exe (PID: 7788)
      • net.exe (PID: 7432)
      • net.exe (PID: 7880)
      • net.exe (PID: 7648)
      • net.exe (PID: 7464)
      • net.exe (PID: 7864)
      • net.exe (PID: 7544)
      • net.exe (PID: 7380)
      • net.exe (PID: 7732)
      • net.exe (PID: 8052)
      • net.exe (PID: 8164)
      • net.exe (PID: 7968)
      • net.exe (PID: 7428)
      • net.exe (PID: 7200)
      • net.exe (PID: 7584)
      • net.exe (PID: 7344)
      • net.exe (PID: 6040)
      • net.exe (PID: 8108)
      • net.exe (PID: 7920)
      • net.exe (PID: 7928)
      • net.exe (PID: 7984)
      • net.exe (PID: 7324)
      • net.exe (PID: 7600)
      • net.exe (PID: 7256)
      • net.exe (PID: 7356)
      • net.exe (PID: 8120)
      • net.exe (PID: 7288)
      • net.exe (PID: 7812)
      • net.exe (PID: 7836)
      • net.exe (PID: 7980)
      • net.exe (PID: 7832)
      • net.exe (PID: 7672)
      • net.exe (PID: 8080)
      • net.exe (PID: 7796)
      • net.exe (PID: 7312)
      • net.exe (PID: 7444)
      • net.exe (PID: 5436)
      • net.exe (PID: 6512)
      • net.exe (PID: 7512)
      • net.exe (PID: 6488)
      • net.exe (PID: 6576)
      • net.exe (PID: 8124)
      • net.exe (PID: 1012)
      • net.exe (PID: 5228)
      • net.exe (PID: 5984)
      • net.exe (PID: 7848)
      • net.exe (PID: 5756)
      • net.exe (PID: 7572)
      • net.exe (PID: 1096)
      • net.exe (PID: 3240)
      • net.exe (PID: 7932)
      • net.exe (PID: 2240)
      • net.exe (PID: 8296)
      • net.exe (PID: 8384)
      • net.exe (PID: 8468)
      • net.exe (PID: 8560)
      • net.exe (PID: 8648)
      • net.exe (PID: 8732)
      • net.exe (PID: 8208)
      • net.exe (PID: 8824)
      • net.exe (PID: 8912)
      • net.exe (PID: 9000)
      • net.exe (PID: 8408)
      • net.exe (PID: 9084)
      • net.exe (PID: 9176)
      • net.exe (PID: 7756)
      • net.exe (PID: 8216)
      • net.exe (PID: 8536)
      • net.exe (PID: 8908)
      • net.exe (PID: 8688)
      • net.exe (PID: 8464)
      • net.exe (PID: 8260)
      • net.exe (PID: 8676)
      • net.exe (PID: 9076)
      • net.exe (PID: 9100)
      • net.exe (PID: 9016)
      • net.exe (PID: 8772)
      • net.exe (PID: 8612)
      • net.exe (PID: 900)
      • net.exe (PID: 4188)
      • net.exe (PID: 8400)
      • net.exe (PID: 8548)
      • net.exe (PID: 8868)
      • net.exe (PID: 8956)
      • net.exe (PID: 9128)
      • net.exe (PID: 7228)
      • net.exe (PID: 8372)
      • net.exe (PID: 8592)
      • net.exe (PID: 8808)
      • net.exe (PID: 8964)
      • net.exe (PID: 8892)
      • net.exe (PID: 1240)
      • net.exe (PID: 8600)
      • net.exe (PID: 1040)
      • net.exe (PID: 8428)
      • net.exe (PID: 8848)
      • net.exe (PID: 9052)
      • net.exe (PID: 8556)
      • net.exe (PID: 8488)
      • net.exe (PID: 8504)
      • net.exe (PID: 3676)
      • net.exe (PID: 8508)
      • net.exe (PID: 9212)
      • net.exe (PID: 8452)
      • net.exe (PID: 8496)
      • net.exe (PID: 8640)
      • net.exe (PID: 8768)
      • net.exe (PID: 8996)
      • net.exe (PID: 8172)

    • XORed URL has been found (YARA)

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Uses TASKKILL.EXE to kill antiviruses

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 9464)

    • MEDUSA has been detected

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • RANSOMWARE has been detected

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • MEDUSA note has been found

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Uses TASKKILL.EXE to kill Office Apps

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Uses TASKKILL.EXE to kill Browsers

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Creates file in the systems drive root

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)

  • INFO

    • Checks supported languages

      • 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe (PID: 5332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(5332) 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
Decrypted-URLs (7)http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/800864f3ec6807f3942442f080b719f3
http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/800864f3ec6807f3942442f080b719f3
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:25 06:40:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 193024
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
629
Monitored processes
505
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
632C:\WINDOWS\system32\net1 stop "SQLAgent$BKUPEXEC" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812taskkill /F /IM wordpad.exe /TC:\Windows\SysWOW64\taskkill.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
900net stop "Sophos AutoUpdate Service" /yC:\Windows\SysWOW64\net.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012net stop "SQLAgent$VEEAMSQL2008R2" /yC:\Windows\SysWOW64\net.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1040\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1040net stop "NetMsmqActivator" /yC:\Windows\SysWOW64\net.exe—4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 057
Read events
12 057
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
6 256
Text files
966
Unknown types
0

Dropped files

PID
Process
Filename
Type
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xmlbinary
MD5:562D440A659D652F4F96277E84A30D72
SHA256:F813C4CE51791EDE54126EE6D56A42CDFFA17035F219BD88DFDF7FDF17A8AD28
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:AF9467DFECDC2845C0BAA4A29DD7B700
SHA256:262B15D97DC619ADF42B12379404058E3EBC1A1237FA72C725DB44FEDDEC88E0
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:B7EBF3B57CE1FAFAAD783718D80145FC
SHA256:FFF6E7B6DEA237BB2267A97CB736E62ADA8E8BB94F6211E4E5034648B2C39781
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:D8E089E25C7E404CAA59182F2ACCB44D
SHA256:50A945329B03E71DCD226DE66FCDA3F0C1F93EBEF0283ACCA03495517F3A9525
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:4FEA666C3BE2136DF2E325032785A691
SHA256:5C409BD14AD59D39F8D0BA54576BF35D52B67637896B9722B3B3796D9CE940A4
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xmlbinary
MD5:FB3A6AB71A6B17C2ADE0A340D7C1873F
SHA256:75488106139851B24A57D10A2F7A7C6F782D126D73CB3068708F1DE6318CEE42
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:F087A1532841140F7C6B673A3E0E4966
SHA256:8791F0093F89D173902E23BB9A6AAFD813FF7A2ABECB3F875B9D3308BB33A508
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:F087A1532841140F7C6B673A3E0E4966
SHA256:8791F0093F89D173902E23BB9A6AAFD813FF7A2ABECB3F875B9D3308BB33A508
53324a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exeC:\ProgramData\Adobe\ARM\S\!!!READ_ME_MEDUSA!!!.txttext
MD5:7A4901702A604CBE487210EA8BDD967B
SHA256:EE46BB9E755D0EC525E9D0D146A9A49449B919B26AE96ABFF94AD3D39CB8CAEE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
52
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
9804
SIHClient.exe
GET
200
23.216.77.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
9804
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
9804
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
20.109.210.53:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
9804
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.20
  • 23.216.77.25
  • 23.216.77.34
  • 23.216.77.37
  • 23.216.77.27
  • 23.216.77.41
  • 23.216.77.26
  • 23.216.77.18
  • 23.216.77.43
  • 23.216.77.21
  • 23.216.77.33
  • 23.216.77.8
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.2
  • 20.190.160.17
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4a0e7565db16ed833a083bc9927f032be5e6918eed712982cd76e87e99510778.exe