File name:

c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4

Full analysis: https://app.any.run/tasks/411be75b-e377-4dcf-b0e9-167193e8570b
Verdict: Malicious activity
Threats:

Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 15:45:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
medusa
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

EB46BC3E2AD88149176EF33C9FEA087A

SHA1:

A324F02D8FD3F4C4167E7A30123B2C8B5B20EE5A

SHA256:

C9ABFC3E4DA474E18795F5261F77E60C44E7B3353771281E4304E7506D56FDB4

SSDEEP:

24576:DRSZ+xfS7o0NMG7IdnWWdBlV1dMQ3SaG:DRSZ+xfS7o0NMG7IdnWWdXV16Q3SaG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 6068)
      • net.exe (PID: 7372)
      • net.exe (PID: 7192)
      • net.exe (PID: 7276)
      • net.exe (PID: 7468)
      • net.exe (PID: 7560)
      • net.exe (PID: 7648)
      • net.exe (PID: 7736)
      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)
      • net.exe (PID: 7824)
      • net.exe (PID: 7908)
      • net.exe (PID: 7992)
      • net.exe (PID: 8080)
      • net.exe (PID: 8168)
      • net.exe (PID: 7152)
      • net.exe (PID: 7500)
      • net.exe (PID: 4300)
      • net.exe (PID: 7724)
      • net.exe (PID: 7840)
      • net.exe (PID: 7664)
      • net.exe (PID: 7732)
      • net.exe (PID: 5164)
      • net.exe (PID: 4008)
      • net.exe (PID: 5936)
      • net.exe (PID: 8056)
      • net.exe (PID: 7256)
      • net.exe (PID: 7572)
      • net.exe (PID: 7424)
      • net.exe (PID: 5728)
      • net.exe (PID: 7632)
      • net.exe (PID: 7848)
      • net.exe (PID: 4920)
      • net.exe (PID: 1532)
      • net.exe (PID: 7524)
      • net.exe (PID: 5256)
      • net.exe (PID: 8012)
      • net.exe (PID: 7332)
      • net.exe (PID: 6476)
      • net.exe (PID: 7804)
      • net.exe (PID: 7208)
      • net.exe (PID: 7544)
      • net.exe (PID: 6156)
      • net.exe (PID: 8004)
      • net.exe (PID: 2244)
      • net.exe (PID: 7244)
      • net.exe (PID: 7612)
      • net.exe (PID: 7668)
      • net.exe (PID: 3784)
      • net.exe (PID: 6032)
      • net.exe (PID: 6676)
      • net.exe (PID: 5116)
      • net.exe (PID: 7836)
      • net.exe (PID: 3300)
      • net.exe (PID: 5892)
      • net.exe (PID: 1240)
      • net.exe (PID: 720)
      • net.exe (PID: 1568)
      • net.exe (PID: 1388)
      • net.exe (PID: 8088)
      • net.exe (PID: 8068)
      • net.exe (PID: 6044)
      • net.exe (PID: 7448)
      • net.exe (PID: 7888)
      • net.exe (PID: 2240)
      • net.exe (PID: 632)
      • net.exe (PID: 5608)
      • net.exe (PID: 2320)
      • net.exe (PID: 4464)
      • net.exe (PID: 7240)
      • net.exe (PID: 5436)
      • net.exe (PID: 2340)
      • net.exe (PID: 5720)
      • net.exe (PID: 4736)
      • net.exe (PID: 1128)
      • net.exe (PID: 1272)
      • net.exe (PID: 7656)
      • net.exe (PID: 8064)
      • net.exe (PID: 4220)
      • net.exe (PID: 1012)
      • net.exe (PID: 5756)
      • net.exe (PID: 6080)
      • net.exe (PID: 7976)
      • net.exe (PID: 8204)
      • net.exe (PID: 8296)
      • net.exe (PID: 8472)
      • net.exe (PID: 8384)
      • net.exe (PID: 7384)
      • net.exe (PID: 6824)
      • net.exe (PID: 4200)
      • net.exe (PID: 7180)
      • net.exe (PID: 780)
      • net.exe (PID: 9000)
      • net.exe (PID: 9088)
      • net.exe (PID: 8556)
      • net.exe (PID: 8644)
      • net.exe (PID: 8736)
      • net.exe (PID: 8824)
      • net.exe (PID: 8912)
      • net.exe (PID: 9176)
      • net.exe (PID: 7416)
      • net.exe (PID: 8908)
      • net.exe (PID: 9020)
      • net.exe (PID: 8776)
      • net.exe (PID: 8636)
      • net.exe (PID: 8692)
      • net.exe (PID: 8408)
      • net.exe (PID: 8312)
      • net.exe (PID: 8212)
      • net.exe (PID: 8276)
      • net.exe (PID: 8856)
      • net.exe (PID: 8508)
      • net.exe (PID: 8652)
      • net.exe (PID: 6752)
      • net.exe (PID: 8980)
      • net.exe (PID: 8756)
      • net.exe (PID: 8356)
      • net.exe (PID: 8400)
      • net.exe (PID: 8260)
      • net.exe (PID: 8428)
      • net.exe (PID: 8596)
      • net.exe (PID: 9160)
      • net.exe (PID: 8536)
      • net.exe (PID: 8784)
      • net.exe (PID: 8960)
      • net.exe (PID: 8904)
      • net.exe (PID: 9048)
      • net.exe (PID: 9116)
      • net.exe (PID: 8456)
      • net.exe (PID: 8848)
      • net.exe (PID: 8604)
      • net.exe (PID: 8608)
      • net.exe (PID: 8416)
      • net.exe (PID: 9128)
      • net.exe (PID: 8404)
      • net.exe (PID: 8496)
      • net.exe (PID: 8576)
      • net.exe (PID: 8656)
      • net.exe (PID: 8512)
      • net.exe (PID: 660)
      • net.exe (PID: 8320)
      • net.exe (PID: 8500)

    • XORed URL has been found (YARA)

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Uses TASKKILL.EXE to kill antiviruses

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 4212)

    • MEDUSA has been detected

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • RANSOMWARE has been detected

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • MEDUSA note has been found

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Browsers

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Uses TASKKILL.EXE to kill process

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Uses TASKKILL.EXE to kill Office Apps

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Creates file in the systems drive root

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

    • Write to the desktop.ini file (may be used to cloak folders)

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)

  • INFO

    • Checks supported languages

      • c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe (PID: 2136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(2136) c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
Decrypted-URLs (7)http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/d96ac6bae7c7117b47cc926b0dff683f
http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/d96ac6bae7c7117b47cc926b0dff683f
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:20 21:14:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 488960
InitializedDataSize: 192512
UninitializedDataSize: -
EntryPoint: 0x37bfa
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
643
Monitored processes
516
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs sppextcomobj.exe no specs slui.exe net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\net1 stop "SQLSERVERAGENT" /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
632net stop "SNAC" /yC:\Windows\SysWOW64\net.exe—c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
644taskkill /F /IM ocautoupds.exe /TC:\Windows\SysWOW64\taskkill.exe—c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660net stop "KAVFSGT" /yC:\Windows\SysWOW64\net.exe—c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
720net stop "RESvc" /yC:\Windows\SysWOW64\net.exe—c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780net stop "SQLAgent$VEEAMSQL2012" /yC:\Windows\SysWOW64\net.exe—c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
9 223
Read events
9 223
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
4 446
Text files
659
Unknown types
1

Dropped files

PID
Process
Filename
Type
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\Program Files\Mozilla Firefox\omni.ja —
MD5:—
SHA256:—
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\!!!READ_ME_MEDUSA!!!.txttext
MD5:8DCBA16DF7E42EFB90843BD185D579C3
SHA256:10019FBEA76C4C5CF440A25905E574D651E884B224FAF29D8BF34ED52F323C0F
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\ProgramData\Adobe\!!!READ_ME_MEDUSA!!!.txttext
MD5:8DCBA16DF7E42EFB90843BD185D579C3
SHA256:10019FBEA76C4C5CF440A25905E574D651E884B224FAF29D8BF34ED52F323C0F
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\ProgramData\Adobe\ARM\!!!READ_ME_MEDUSA!!!.txttext
MD5:8DCBA16DF7E42EFB90843BD185D579C3
SHA256:10019FBEA76C4C5CF440A25905E574D651E884B224FAF29D8BF34ED52F323C0F
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\ProgramData\Adobe\ARM\S\!!!READ_ME_MEDUSA!!!.txttext
MD5:8DCBA16DF7E42EFB90843BD185D579C3
SHA256:10019FBEA76C4C5CF440A25905E574D651E884B224FAF29D8BF34ED52F323C0F
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.inibinary
MD5:83F3FBF418695BF56E8C642BE316CC07
SHA256:E6FC8CE747FE92AC5476FA8BDAF6EC75F78694B56688CFAA861623D372897863
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.MEDUSAbinary
MD5:83F3FBF418695BF56E8C642BE316CC07
SHA256:E6FC8CE747FE92AC5476FA8BDAF6EC75F78694B56688CFAA861623D372897863
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xmlbinary
MD5:6CFFEBE02A8BE8B722FA18DB7115662D
SHA256:695DEA43971B7394A17D504FC631CBFB4A0F8994AAA76B2987ED7B0A9536D433
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.jsonbinary
MD5:26F5C6A29845984515BFEE9A1CA45C95
SHA256:7A05264707668986FE17AFFF980BA66A4DFC528FE70BC0BEB4995039C5532266
2136c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4.exeC:\ProgramData\Adobe\ARM\S\388\!!!READ_ME_MEDUSA!!!.txttext
MD5:8DCBA16DF7E42EFB90843BD185D579C3
SHA256:10019FBEA76C4C5CF440A25905E574D651E884B224FAF29D8BF34ED52F323C0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
9296
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9296
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
9296
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.3
  • 40.126.32.140
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c9abfc3e4da474e18795f5261f77e60c44e7b3353771281e4304e7506d56fdb4