File name:

a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239

Full analysis: https://app.any.run/tasks/6760f80a-88d1-4be7-ae60-73ce720ee56f
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 16:00:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

6BE23D5A1FF1E9CBE99FE7F7C49A5607

SHA1:

A338CA828419DA8B71CE35A49AFCA1BABCD0A2CF

SHA256:

A0CEBCC9F5893B2FDE2806794C27B8A304A0EB863E128AD779ED5DD806AD9239

SSDEEP:

12288:VG4+nZKxtgyo0uHG7o97jOvbuvifWKwz7xZYTuFrqcd0qcRXzs9mH5:0FnZKxtgyo0uHG7o9IfWKG7xZYnciz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 7592)
      • net.exe (PID: 7336)
      • net.exe (PID: 7680)
      • net.exe (PID: 7508)
      • net.exe (PID: 7936)
      • net.exe (PID: 7424)
      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)
      • net.exe (PID: 8016)
      • net.exe (PID: 8148)
      • net.exe (PID: 5548)
      • net.exe (PID: 7408)
      • net.exe (PID: 728)
      • net.exe (PID: 7248)
      • net.exe (PID: 8024)
      • net.exe (PID: 8112)
      • net.exe (PID: 7232)
      • net.exe (PID: 7848)
      • net.exe (PID: 7396)
      • net.exe (PID: 7308)
      • net.exe (PID: 7764)
      • net.exe (PID: 7464)
      • net.exe (PID: 7584)
      • net.exe (PID: 7624)
      • net.exe (PID: 7700)
      • net.exe (PID: 8104)
      • net.exe (PID: 7748)
      • net.exe (PID: 7400)
      • net.exe (PID: 7452)
      • net.exe (PID: 7928)
      • net.exe (PID: 7728)
      • net.exe (PID: 7608)
      • net.exe (PID: 7620)
      • net.exe (PID: 8084)
      • net.exe (PID: 7344)
      • net.exe (PID: 7656)
      • net.exe (PID: 7960)
      • net.exe (PID: 7236)
      • net.exe (PID: 7884)
      • net.exe (PID: 7484)
      • net.exe (PID: 7208)
      • net.exe (PID: 6032)
      • net.exe (PID: 6644)
      • net.exe (PID: 8004)
      • net.exe (PID: 8088)
      • net.exe (PID: 7368)
      • net.exe (PID: 7836)
      • net.exe (PID: 8184)
      • net.exe (PID: 7800)
      • net.exe (PID: 5972)
      • net.exe (PID: 5868)
      • net.exe (PID: 8056)
      • net.exe (PID: 5400)
      • net.exe (PID: 6456)
      • net.exe (PID: 3768)
      • net.exe (PID: 3676)
      • net.exe (PID: 8140)
      • net.exe (PID: 3884)
      • net.exe (PID: 7792)
      • net.exe (PID: 7964)
      • net.exe (PID: 8160)
      • net.exe (PID: 5964)
      • net.exe (PID: 7384)
      • net.exe (PID: 6620)
      • net.exe (PID: 1240)
      • net.exe (PID: 6240)
      • net.exe (PID: 2088)
      • net.exe (PID: 7944)
      • net.exe (PID: 5436)
      • net.exe (PID: 3304)
      • net.exe (PID: 6512)
      • net.exe (PID: 4452)
      • net.exe (PID: 4408)
      • net.exe (PID: 1532)
      • net.exe (PID: 7460)
      • net.exe (PID: 1188)
      • net.exe (PID: 3008)
      • net.exe (PID: 7676)
      • net.exe (PID: 2320)
      • net.exe (PID: 8208)
      • net.exe (PID: 8308)
      • net.exe (PID: 8448)
      • net.exe (PID: 8540)
      • net.exe (PID: 9112)
      • net.exe (PID: 8828)
      • net.exe (PID: 8940)
      • net.exe (PID: 9028)
      • net.exe (PID: 8316)
      • net.exe (PID: 5200)
      • net.exe (PID: 7976)
      • net.exe (PID: 8648)
      • net.exe (PID: 8736)
      • net.exe (PID: 2108)
      • net.exe (PID: 8092)
      • net.exe (PID: 7776)
      • net.exe (PID: 2040)
      • net.exe (PID: 7688)
      • net.exe (PID: 8392)
      • net.exe (PID: 8536)
      • net.exe (PID: 8664)
      • net.exe (PID: 8516)
      • net.exe (PID: 9196)
      • net.exe (PID: 8396)
      • net.exe (PID: 8468)
      • net.exe (PID: 4212)
      • net.exe (PID: 9048)
      • net.exe (PID: 8900)
      • net.exe (PID: 8272)
      • net.exe (PID: 8204)
      • net.exe (PID: 904)
      • net.exe (PID: 8620)
      • net.exe (PID: 8716)
      • net.exe (PID: 8588)
      • net.exe (PID: 9016)
      • net.exe (PID: 8924)
      • net.exe (PID: 9108)
      • net.exe (PID: 6752)
      • net.exe (PID: 8376)
      • net.exe (PID: 5936)
      • net.exe (PID: 6712)
      • net.exe (PID: 8488)
      • net.exe (PID: 8420)
      • net.exe (PID: 8580)
      • net.exe (PID: 8760)
      • net.exe (PID: 6228)
      • net.exe (PID: 9020)
      • net.exe (PID: 1132)
      • net.exe (PID: 8404)
      • net.exe (PID: 8640)
      • net.exe (PID: 6132)
      • net.exe (PID: 8816)
      • net.exe (PID: 8284)
      • net.exe (PID: 1180)
      • net.exe (PID: 8932)
      • net.exe (PID: 8968)
      • net.exe (PID: 9100)
      • net.exe (PID: 1388)
      • net.exe (PID: 8600)
      • net.exe (PID: 9076)
      • net.exe (PID: 8756)
      • net.exe (PID: 8904)
      • net.exe (PID: 3332)
      • net.exe (PID: 8612)
      • net.exe (PID: 616)
      • net.exe (PID: 8436)
      • net.exe (PID: 8840)
      • net.exe (PID: 8440)
      • net.exe (PID: 4400)
      • net.exe (PID: 8964)
      • net.exe (PID: 3900)
      • net.exe (PID: 8264)
      • net.exe (PID: 1040)
      • net.exe (PID: 8564)
      • net.exe (PID: 9148)
      • net.exe (PID: 8292)
      • net.exe (PID: 8340)

    • XORed URL has been found (YARA)

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Uses TASKKILL.EXE to kill antiviruses

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • MEDUSA note has been found

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • MEDUSA has been detected

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • RANSOMWARE has been detected

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 8228)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Browsers

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Uses TASKKILL.EXE to kill Office Apps

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Write to the desktop.ini file (may be used to cloak folders)

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Executable content was dropped or overwritten

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Creates file in the systems drive root

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

    • Uses TASKKILL.EXE to kill process

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)

  • INFO

    • Checks supported languages

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 4996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(4996) a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
Decrypted-URLs (6)http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/ff1fe92cb533e46c36c25da2523b8f1f
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:19 10:19:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
687
Monitored processes
557
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs sppextcomobj.exe no specs net1.exe no specs net.exe no specs slui.exe conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616net stop "MSSQL$SOPHOS" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680taskkill /F /IM xfssvccon.exe /TC:\Windows\SysWOW64\taskkill.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
728net stop "Acronis VSS Provider" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
736C:\WINDOWS\system32\net1 stop "SmcService" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904net stop "swi_update_64" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
9 767
Read events
9 767
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
3 050
Text files
333
Unknown types
0

Dropped files

PID
Process
Filename
Type
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:869E794F21DBC7F8CA5342C450AF053C
SHA256:093D3F75952B37685CB6BB2E7FFDE2D0DC7D2E966536F977AE6AD07D7367E023
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:58969CBC63623903060EB988E9B1903D
SHA256:8F3A7B2CA7093E00CED889A3BC13690920673ABCFE1CF2F57B75DF4F61B43C26
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:3FB8A4834FDEDA94A9204FF84014CD14
SHA256:959E1C78B73A09311C7E1834828B7827C1081288F72B60C279D0643DF527AD39
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xmlbinary
MD5:19796BA589AC7D5FF5133C6D484741DB
SHA256:E7015C4E1712F965EDB488B8904EF99A25C3EB10FC1341A523388F39E655EED2
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:1E42D09B97D78AE198C0CEFEA3FC47D4
SHA256:BC85733BEEB06F8D0CED15A6AEE18B09CD86E4793671F8B1F11E2EE93BB605A1
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:4AB17988844477AA4C5B3AE00C7CC5EE
SHA256:147D1FDF8FBF4424BD6AF9D4B3220E1159948624AED89A622E4C170AFAB9D569
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:E942DCCB688BB08835D2666CBEEA54C9
SHA256:7D6F9B93825548C2D449B463F61FFF1779CF7AF1B8BE3DC121E5FDC774D3598A
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:1E42D09B97D78AE198C0CEFEA3FC47D4
SHA256:BC85733BEEB06F8D0CED15A6AEE18B09CD86E4793671F8B1F11E2EE93BB605A1
4996a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.manbinary
MD5:741EDA7C870F7504683B51E3CA5E638D
SHA256:793010BD830B692C41326250857F540EA5CC17F1C10BB773D11BEBCD5DA4048A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
9180
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
9180
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.41:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2104
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.41
  • 23.216.77.5
  • 23.216.77.31
  • 23.216.77.7
  • 23.216.77.34
  • 23.216.77.27
  • 23.216.77.39
  • 23.216.77.30
  • 23.216.77.10
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.131
  • 40.126.31.71
  • 20.190.159.131
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.2
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239