File name:

94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe

Full analysis: https://app.any.run/tasks/6b8ee2e2-ea4b-45b5-9bf4-d7ce72eef250
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:49:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

F05B57CDC3420ACC359EFE9E4941C428

SHA1:

C06377E90B73BB25D30D385D7E75AE500C7BDC16

SHA256:

94F420E16A4EB5154076895CD8C5F677DB4273D37D44B81E1D04B26E851B69FE

SSDEEP:

24576:3y1OsTYXoVmOG7tGEnW6D7oQOQZ/pKTM:3y1OsTYXoVmOG7tGEnW6PoQlZ/pKTM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 7596)
      • net.exe (PID: 7508)
      • net.exe (PID: 7420)
      • net.exe (PID: 7684)
      • net.exe (PID: 7772)
      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)
      • net.exe (PID: 7860)
      • net.exe (PID: 7948)
      • net.exe (PID: 7444)
      • net.exe (PID: 8040)
      • net.exe (PID: 7524)
      • net.exe (PID: 7616)
      • net.exe (PID: 7704)
      • net.exe (PID: 7792)
      • net.exe (PID: 7780)
      • net.exe (PID: 6132)
      • net.exe (PID: 4164)
      • net.exe (PID: 2692)
      • net.exe (PID: 5064)
      • net.exe (PID: 1228)
      • net.exe (PID: 7264)
      • net.exe (PID: 7660)
      • net.exe (PID: 5428)
      • net.exe (PID: 728)
      • net.exe (PID: 5972)
      • net.exe (PID: 7760)
      • net.exe (PID: 7788)
      • net.exe (PID: 7896)
      • net.exe (PID: 8152)
      • net.exe (PID: 1132)
      • net.exe (PID: 1164)
      • net.exe (PID: 4200)
      • net.exe (PID: 5576)
      • net.exe (PID: 7612)
      • net.exe (PID: 7292)
      • net.exe (PID: 7836)
      • net.exe (PID: 7940)
      • net.exe (PID: 6192)
      • net.exe (PID: 4112)
      • net.exe (PID: 6388)
      • net.exe (PID: 7540)
      • net.exe (PID: 5216)
      • net.exe (PID: 3304)
      • net.exe (PID: 7348)
      • net.exe (PID: 6988)
      • net.exe (PID: 7932)
      • net.exe (PID: 8024)
      • net.exe (PID: 660)
      • net.exe (PID: 5048)
      • net.exe (PID: 6744)
      • net.exe (PID: 7464)
      • net.exe (PID: 7884)
      • net.exe (PID: 7756)
      • net.exe (PID: 8144)
      • net.exe (PID: 4408)
      • net.exe (PID: 720)
      • net.exe (PID: 8060)
      • net.exe (PID: 2432)
      • net.exe (PID: 7244)
      • net.exe (PID: 7712)
      • net.exe (PID: 4224)
      • net.exe (PID: 8068)
      • net.exe (PID: 7692)
      • net.exe (PID: 5720)
      • net.exe (PID: 896)
      • net.exe (PID: 7944)
      • net.exe (PID: 7316)
      • net.exe (PID: 8148)
      • net.exe (PID: 7260)
      • net.exe (PID: 3300)
      • net.exe (PID: 7560)
      • net.exe (PID: 6268)
      • net.exe (PID: 8000)
      • net.exe (PID: 6872)
      • net.exe (PID: 7448)
      • net.exe (PID: 7672)
      • net.exe (PID: 5640)
      • net.exe (PID: 7276)
      • net.exe (PID: 8176)
      • net.exe (PID: 7320)
      • net.exe (PID: 5588)
      • net.exe (PID: 3020)
      • net.exe (PID: 864)
      • net.exe (PID: 7676)
      • net.exe (PID: 7784)
      • net.exe (PID: 5164)
      • net.exe (PID: 1764)
      • net.exe (PID: 7432)
      • net.exe (PID: 7520)
      • net.exe (PID: 2852)
      • net.exe (PID: 8072)
      • net.exe (PID: 7820)
      • net.exe (PID: 7504)
      • net.exe (PID: 7984)
      • net.exe (PID: 8172)
      • net.exe (PID: 7648)
      • net.exe (PID: 7920)
      • net.exe (PID: 2268)
      • net.exe (PID: 1660)
      • net.exe (PID: 3008)
      • net.exe (PID: 6752)
      • net.exe (PID: 1328)
      • net.exe (PID: 6512)
      • net.exe (PID: 2984)
      • net.exe (PID: 5964)
      • net.exe (PID: 7192)
      • net.exe (PID: 7748)
      • net.exe (PID: 8048)
      • net.exe (PID: 6592)
      • net.exe (PID: 5228)
      • net.exe (PID: 1040)
      • net.exe (PID: 2240)
      • net.exe (PID: 8212)
      • net.exe (PID: 8304)
      • net.exe (PID: 8392)
      • net.exe (PID: 8556)
      • net.exe (PID: 9000)
      • net.exe (PID: 9088)
      • net.exe (PID: 9172)
      • net.exe (PID: 8416)
      • net.exe (PID: 4300)
      • net.exe (PID: 8536)
      • net.exe (PID: 8224)
      • net.exe (PID: 8932)
      • net.exe (PID: 8776)
      • net.exe (PID: 8604)
      • net.exe (PID: 8684)
      • net.exe (PID: 9012)
      • net.exe (PID: 9152)
      • net.exe (PID: 8196)
      • net.exe (PID: 8288)
      • net.exe (PID: 8480)
      • net.exe (PID: 8824)
      • net.exe (PID: 8644)
      • net.exe (PID: 8736)
      • net.exe (PID: 8908)
      • net.exe (PID: 8352)
      • net.exe (PID: 8460)
      • net.exe (PID: 8592)
      • net.exe (PID: 8784)
      • net.exe (PID: 8872)
      • net.exe (PID: 8248)
      • net.exe (PID: 8544)
      • net.exe (PID: 9164)
      • net.exe (PID: 9080)
      • net.exe (PID: 8284)
      • net.exe (PID: 8512)
      • net.exe (PID: 8688)
      • net.exe (PID: 8680)
      • net.exe (PID: 8940)
      • net.exe (PID: 9064)
      • net.exe (PID: 8452)
      • net.exe (PID: 8524)
      • net.exe (PID: 8956)
      • net.exe (PID: 8780)
      • net.exe (PID: 8772)
      • net.exe (PID: 9116)
      • net.exe (PID: 8584)
      • net.exe (PID: 8200)
      • net.exe (PID: 8424)
      • net.exe (PID: 8548)
      • net.exe (PID: 8552)

    • XORed URL has been found (YARA)

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

    • MEDUSA note has been found

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 744)

    • Uses TASKKILL.EXE to kill antiviruses

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Browsers

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

    • Uses TASKKILL.EXE to kill process

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

    • Uses TASKKILL.EXE to kill Office Apps

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

    • Creates file in the systems drive root

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)

  • INFO

    • Checks supported languages

      • 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe (PID: 7324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(7324) 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
Decrypted-URLs (5)http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/817cbe1cbf9330a3a712d04e151f6d6d
http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:18 15:12:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 190976
UninitializedDataSize: -
EntryPoint: 0x37c1a
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
695
Monitored processes
574
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL 94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516C:\WINDOWS\system32\net1 stop "SQLAgent$SBSMONITORING" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
632C:\WINDOWS\system32\net1 stop "SQLAgent$VEEAMSQL2008R2" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
660net stop "MSSQL$SHAREPOINT" /yC:\Windows\SysWOW64\net.exe—94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720net stop "MSOLAP$SQL_2008" /yC:\Windows\SysWOW64\net.exe—94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
728net stop "McAfeeFrameworkMcAfeeFramework" /yC:\Windows\SysWOW64\net.exe—94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
744taskkill /F /IM Ntrtscan.exe /TC:\Windows\SysWOW64\taskkill.exe—94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856C:\WINDOWS\system32\net1 stop "SQLBrowser" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
12 792
Read events
12 792
Write events
0
Delete events
0

Modification events

No data
Executable files
32
Suspicious files
6 969
Text files
1 138
Unknown types
0

Dropped files

PID
Process
Filename
Type
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.manbinary
MD5:BC8BF667F2A44821FE927450CA65F008
SHA256:F640EE86CC86616B2654139904CFA91C1262184AD806984E46DF02D2C650D8FD
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xmlbinary
MD5:1DEFFC2CE3F785CF9E44D2ED6F7DE73B
SHA256:8BD3082568659588BF764C1A6760B50923EE7D0A33C5E79918546452546DAD03
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:2BE343FEAE5834860DA93B2F97E3F2F9
SHA256:35E2680FD2CF081F7E9EA24C3AFB3EC725A004D4CC318B98A9530CCE748B72DE
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xmlbinary
MD5:BE9CA1B7F5750B00E3A766A20BC34444
SHA256:7C8013586A1E607201C85D8738430D848CDD700E32BBBA1EEF822645FFF9354C
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.manbinary
MD5:7BF4874264DBBE7285588472338C80FA
SHA256:AD21B7B785A63FC0BCA17753EA0C5BB357CF7583FE1A410E64C79716AEFB439F
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:83EB85F0AAE208A94B7795BEF30BB194
SHA256:76EBB430488CD617CAB54F03D99E2FDB51D7988F913E87B400CA5CDB30C344DA
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:26B18923EABD859E20CF831B1B730B78
SHA256:C2F48217609A9B841FAD1DE1FE4FD85DFF92CE1A371C6A4BF34A5B49DD8DC2EA
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:B3D2F56C55F1524F836BF3A6D152E942
SHA256:36E0ED00499DDEE5E053C0D8167BE723A0CA8AA10775BFCB9EDF73D2584249E0
732494f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:E54D836A895FE67FC94822CE96A16B74
SHA256:825044A619EC86D53685BFF492B310486206B5F83A88C06DE2BA3EF74EBBE4A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
43
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
9240
SIHClient.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
9240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
9240
SIHClient.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
9240
SIHClient.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
200
4.175.87.197:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
9240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
9240
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
9240
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
9240
SIHClient.exe
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
9240
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
9240
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6564
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 172.217.23.110
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.18
  • 23.216.77.33
  • 23.216.77.27
  • 23.216.77.8
  • 23.216.77.42
  • 23.216.77.43
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.132
  • 40.126.32.72
  • 20.190.160.67
  • 20.190.160.5
  • 40.126.32.140
  • 20.190.160.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
94f420e16a4eb5154076895cd8c5f677db4273d37d44b81e1d04b26e851b69fe.exe