File name:

a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239

Full analysis: https://app.any.run/tasks/e1dd766b-5f9e-470d-89b2-6eb0c04dfa6a
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:50:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

6BE23D5A1FF1E9CBE99FE7F7C49A5607

SHA1:

A338CA828419DA8B71CE35A49AFCA1BABCD0A2CF

SHA256:

A0CEBCC9F5893B2FDE2806794C27B8A304A0EB863E128AD779ED5DD806AD9239

SSDEEP:

12288:VG4+nZKxtgyo0uHG7o97jOvbuvifWKwz7xZYTuFrqcd0qcRXzs9mH5:0FnZKxtgyo0uHG7o9IfWKG7xZYnciz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 7276)
      • net.exe (PID: 7184)
      • net.exe (PID: 6480)
      • net.exe (PID: 1348)
      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)
      • net.exe (PID: 5416)
      • net.exe (PID: 672)
      • net.exe (PID: 7196)
      • net.exe (PID: 7784)
      • net.exe (PID: 1300)
      • net.exe (PID: 8012)
      • net.exe (PID: 2392)
      • net.exe (PID: 8080)
      • net.exe (PID: 5256)
      • net.exe (PID: 1672)
      • net.exe (PID: 4224)
      • net.exe (PID: 1228)
      • net.exe (PID: 8064)
      • net.exe (PID: 7984)
      • net.exe (PID: 8028)
      • net.exe (PID: 7416)
      • net.exe (PID: 2096)
      • net.exe (PID: 7844)
      • net.exe (PID: 6800)
      • net.exe (PID: 7516)
      • net.exe (PID: 7440)
      • net.exe (PID: 6988)
      • net.exe (PID: 5548)
      • net.exe (PID: 7332)
      • net.exe (PID: 3676)
      • net.exe (PID: 7412)
      • net.exe (PID: 5204)
      • net.exe (PID: 7924)
      • net.exe (PID: 8140)
      • net.exe (PID: 4408)
      • net.exe (PID: 2692)
      • net.exe (PID: 5728)
      • net.exe (PID: 7836)
      • net.exe (PID: 4920)
      • net.exe (PID: 5352)
      • net.exe (PID: 7228)
      • net.exe (PID: 7716)
      • net.exe (PID: 5984)
      • net.exe (PID: 5892)
      • net.exe (PID: 7424)
      • net.exe (PID: 5608)
      • net.exe (PID: 6576)
      • net.exe (PID: 5772)
      • net.exe (PID: 7688)
      • net.exe (PID: 7528)
      • net.exe (PID: 8088)
      • net.exe (PID: 516)
      • net.exe (PID: 1128)
      • net.exe (PID: 1568)
      • net.exe (PID: 6656)
      • net.exe (PID: 4464)
      • net.exe (PID: 4988)
      • net.exe (PID: 5008)
      • net.exe (PID: 7496)
      • net.exe (PID: 864)
      • net.exe (PID: 1012)
      • net.exe (PID: 8076)
      • net.exe (PID: 6112)
      • net.exe (PID: 7760)
      • net.exe (PID: 2088)
      • net.exe (PID: 2040)
      • net.exe (PID: 7428)
      • net.exe (PID: 4620)
      • net.exe (PID: 7664)
      • net.exe (PID: 2984)
      • net.exe (PID: 4068)
      • net.exe (PID: 1020)
      • net.exe (PID: 7396)
      • net.exe (PID: 208)
      • net.exe (PID: 1272)
      • net.exe (PID: 7484)
      • net.exe (PID: 1628)
      • net.exe (PID: 4976)
      • net.exe (PID: 1764)
      • net.exe (PID: 5776)
      • net.exe (PID: 8048)
      • net.exe (PID: 5228)
      • net.exe (PID: 3268)
      • net.exe (PID: 4112)
      • net.exe (PID: 2616)
      • net.exe (PID: 7492)
      • net.exe (PID: 8292)
      • net.exe (PID: 8208)
      • net.exe (PID: 7084)
      • net.exe (PID: 7172)
      • net.exe (PID: 8384)
      • net.exe (PID: 8468)
      • net.exe (PID: 8908)
      • net.exe (PID: 8640)
      • net.exe (PID: 8556)
      • net.exe (PID: 8732)
      • net.exe (PID: 8820)
      • net.exe (PID: 8992)
      • net.exe (PID: 9084)
      • net.exe (PID: 8672)
      • net.exe (PID: 8532)
      • net.exe (PID: 8632)
      • net.exe (PID: 8200)
      • net.exe (PID: 9172)
      • net.exe (PID: 8408)
      • net.exe (PID: 8216)
      • net.exe (PID: 9012)
      • net.exe (PID: 8772)
      • net.exe (PID: 8828)
      • net.exe (PID: 9156)
      • net.exe (PID: 8196)
      • net.exe (PID: 8284)
      • net.exe (PID: 8536)
      • net.exe (PID: 8372)
      • net.exe (PID: 8636)
      • net.exe (PID: 8776)
      • net.exe (PID: 8864)
      • net.exe (PID: 8952)
      • net.exe (PID: 9096)
      • net.exe (PID: 9120)
      • net.exe (PID: 8400)
      • net.exe (PID: 8300)
      • net.exe (PID: 8508)
      • net.exe (PID: 8664)
      • net.exe (PID: 9144)
      • net.exe (PID: 8804)
      • net.exe (PID: 6148)
      • net.exe (PID: 9048)
      • net.exe (PID: 8916)
      • net.exe (PID: 8276)
      • net.exe (PID: 8496)
      • net.exe (PID: 8348)
      • net.exe (PID: 8584)
      • net.exe (PID: 8880)
      • net.exe (PID: 9044)
      • net.exe (PID: 8520)
      • net.exe (PID: 8476)
      • net.exe (PID: 8656)
      • net.exe (PID: 8852)
      • net.exe (PID: 9128)

    • XORed URL has been found (YARA)

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 9536)

    • Uses TASKKILL.EXE to kill antiviruses

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • MEDUSA has been detected

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • RANSOMWARE has been detected

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • MEDUSA note has been found

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Office Apps

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • Uses TASKKILL.EXE to kill process

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • Uses TASKKILL.EXE to kill Browsers

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • Write to the desktop.ini file (may be used to cloak folders)

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

    • Creates file in the systems drive root

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)

  • INFO

    • Checks supported languages

      • a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe (PID: 2284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(2284) a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
Decrypted-URLs (6)http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/ff1fe92cb533e46c36c25da2523b8f1f
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:19 10:19:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
637
Monitored processes
511
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs sppextcomobj.exe no specs slui.exe net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208net stop "SQLAgent$SQL_2008" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
516net stop "MSSQLFDLauncher$PROFXENGAGEMENT" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
644taskkill /F /IM outlook.exe /TC:\Windows\SysWOW64\taskkill.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
660C:\WINDOWS\system32\net1 stop "MSSQL$ECWDB2" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
664C:\WINDOWS\system32\net1 stop "MSSQLFDLauncher$TPSAMA" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
672net stop "MsDtsServer" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728C:\WINDOWS\system32\net1 stop "SMTPSvc" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
864net stop "SAVService" /yC:\Windows\SysWOW64\net.exe—a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
904C:\WINDOWS\system32\net1 stop "OracleClientCache80" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
9 176
Read events
9 176
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
4 050
Text files
567
Unknown types
0

Dropped files

PID
Process
Filename
Type
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:3B6DD6921A9609D43105D1FACF790827
SHA256:ADD9940158157DC3BF5A7586F4AAD525943E4ED1EEA687926E809CD049AC3955
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:A8E152566927800B8138D6F0606C8EB3
SHA256:6519588B0845C887AD25E5C4634E1178B29153C8DFC5374FBDC943CA5E3405DF
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:25EC1C66CB7810BBEA28BA75E3E78E55
SHA256:094F4C4EAB6D52A3EF46003D96C53389FEF28AF805318E9C262B1181F3EAD345
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.manbinary
MD5:679C1A4F1A08E50F23577C78D5278006
SHA256:1061E912AE709DD6A2C77FCD2A34C68C9BE084BAD6B41FB2F78EFE55E84F9875
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.manbinary
MD5:1E32626C66C97105BBFB84CC7918A16F
SHA256:A30629C72180B1240F675C0AF58ACAB93852D715D95702FAA0A29022356CC13F
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.manbinary
MD5:4138ECAC6BC379945854627B03BFDAAE
SHA256:80DBED4C90188AF2EF4D2C5C15728F68C7EFBFE501F41354157B7D1DDC5DAA13
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:A8E152566927800B8138D6F0606C8EB3
SHA256:6519588B0845C887AD25E5C4634E1178B29153C8DFC5374FBDC943CA5E3405DF
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.catbinary
MD5:A7E025852D7B52EB01B015B506F807F6
SHA256:F62B328F64D354D6D6329249DF64B18823BC11BE3D0ECC8A55C031C227A18EB7
2284a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hashbinary
MD5:A4D846A053422AD4E3D0A6E188428DB9
SHA256:631A0CAD958DD46993E5065132C4C51FA7AFC0FB039FD800AE10732462B93C9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
9688
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
9688
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
9688
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.129
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a0cebcc9f5893b2fde2806794c27b8a304a0eb863e128ad779ed5dd806ad9239