File name:

emBridge.exe

Full analysis: https://app.any.run/tasks/c1443671-6575-4f30-a0e6-b830f0be2825
Verdict: Malicious activity
Analysis date: January 07, 2022, 12:48:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A75AEAB3B9EF0B67499A3E6BFDEC54BA

SHA1:

AD7FB68C6A960E4FC1479239DCC197E9E87EA10F

SHA256:

3AD1460DE17F78B2A3E06CC93C1EA8DCF54B445F2889ADE491F0F9C23314FFF4

SSDEEP:

196608:yG92kjIVWgLlfqFOB0eHSR8ntyU7DygJ6M8YYk:yGjjIVWg6V8ntbDd8YYk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • emBridge.exe (PID: 3144)
      • emBridge.exe (PID: 3008)

    • Writes to the hosts file

      • emBridge.tmp (PID: 2156)

    • Writes to a start menu file

      • emBridge.tmp (PID: 2156)

    • Loads dropped or rewritten executable

      • emBridge.exe (PID: 3140)
      • emBridge.exe (PID: 3136)
      • emBridge.exe (PID: 3832)

    • Application was dropped or rewritten from another process

      • emBridge.exe (PID: 3140)
      • emBridge.exe (PID: 3136)
      • emBridge.exe (PID: 3832)

    • Changes settings of System certificates

      • emBridge.exe (PID: 3832)

  • SUSPICIOUS

    • Checks supported languages

      • emBridge.tmp (PID: 2536)
      • emBridge.exe (PID: 3144)
      • emBridge.exe (PID: 3008)
      • emBridge.tmp (PID: 2156)
      • cmd.exe (PID: 2984)
      • emBridge.exe (PID: 3140)
      • emBridge.exe (PID: 3136)
      • emBridge.exe (PID: 3832)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 1252)
      • cmd.exe (PID: 2764)
      • cmd.exe (PID: 872)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1696)
      • cmd.exe (PID: 3160)

    • Executable content was dropped or overwritten

      • emBridge.exe (PID: 3144)
      • emBridge.exe (PID: 3008)
      • emBridge.tmp (PID: 2156)

    • Reads the computer name

      • emBridge.tmp (PID: 2536)
      • emBridge.tmp (PID: 2156)
      • emBridge.exe (PID: 3140)
      • emBridge.exe (PID: 3136)
      • emBridge.exe (PID: 3832)

    • Reads the Windows organization settings

      • emBridge.tmp (PID: 2156)

    • Reads Windows owner or organization settings

      • emBridge.tmp (PID: 2156)

    • Creates a directory in Program Files

      • emBridge.tmp (PID: 2156)

    • Drops a file that was compiled in debug mode

      • emBridge.tmp (PID: 2156)

    • Drops a file with too old compile date

      • emBridge.tmp (PID: 2156)

    • Starts CMD.EXE for commands execution

      • emBridge.tmp (PID: 2156)
      • emBridge.exe (PID: 3832)

    • Creates files in the program directory

      • emBridge.exe (PID: 3140)
      • emBridge.exe (PID: 3832)

    • Creates or modifies windows services

      • emBridge.exe (PID: 3140)

    • Creates files in the Windows directory

      • emBridge.exe (PID: 3832)

    • Reads Environment values

      • emBridge.exe (PID: 3832)
      • netsh.exe (PID: 2508)
      • netsh.exe (PID: 3872)
      • netsh.exe (PID: 1700)
      • netsh.exe (PID: 4024)
      • netsh.exe (PID: 3372)
      • netsh.exe (PID: 2964)

    • Removes files from Windows directory

      • emBridge.exe (PID: 3832)

    • Executed as Windows Service

      • emBridge.exe (PID: 3832)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 1252)
      • cmd.exe (PID: 2764)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1696)

    • Adds / modifies Windows certificates

      • emBridge.exe (PID: 3832)

  • INFO

    • Application was dropped or rewritten from another process

      • emBridge.tmp (PID: 2536)
      • emBridge.tmp (PID: 2156)

    • Reads the hosts file

      • emBridge.tmp (PID: 2156)
      • emBridge.exe (PID: 3140)

    • Creates files in the program directory

      • emBridge.tmp (PID: 2156)

    • Creates a software uninstall entry

      • emBridge.tmp (PID: 2156)

    • Checks supported languages

      • netsh.exe (PID: 2508)
      • netsh.exe (PID: 3872)
      • netsh.exe (PID: 1700)
      • netsh.exe (PID: 4024)
      • netsh.exe (PID: 3372)
      • netsh.exe (PID: 2964)

    • Reads the computer name

      • netsh.exe (PID: 2508)
      • netsh.exe (PID: 3872)
      • netsh.exe (PID: 1700)
      • netsh.exe (PID: 4024)
      • netsh.exe (PID: 3372)
      • netsh.exe (PID: 2964)

    • Reads settings of System Certificates

      • emBridge.exe (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

ProductVersion: 5.8.7.0
ProductName: emBridge
OriginalFileName:
LegalCopyright:
FileVersion: 5.8.7.0
FileDescription: emBridge Setup
CompanyName: eMudhra Limited
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 5.8.7.0
FileVersionNumber: 5.8.7.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: 6
OSVersion: 6.1
EntryPoint: 0xb5eec
UninitializedDataSize: -
InitializedDataSize: 38400
CodeSize: 741376
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 2020:11:15 10:48:30+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Nov-2020 09:48:30
Detected languages:
  • Dutch - Netherlands
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: eMudhra Limited
FileDescription: emBridge Setup
FileVersion: 5.8.7.0
LegalCopyright: -
OriginalFileName: -
ProductName: emBridge
ProductVersion: 5.8.7.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 10
Time date stamp: 15-Nov-2020 09:48:30
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000B361C
0x000B3800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.35606
.itext
0x000B5000
0x00001688
0x00001800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.97275
.data
0x000B7000
0x000037A4
0x00003800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.0444
.bss
0x000BB000
0x00006DE8
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x000C2000
0x00000F36
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.8987
.didata
0x000C3000
0x000001A4
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.75636
.edata
0x000C4000
0x0000009A
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.87222
.tls
0x000C5000
0x00000018
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x000C6000
0x0000005D
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.38389
.rsrc
0x000C7000
0x00004800
0x00004800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.42104

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.18295
1830
UNKNOWN
English - United States
RT_MANIFEST
2
3.47151
1384
UNKNOWN
Dutch - Netherlands
RT_ICON
3
3.91708
744
UNKNOWN
Dutch - Netherlands
RT_ICON
4
3.91366
2216
UNKNOWN
Dutch - Netherlands
RT_ICON
4086
3.16547
864
UNKNOWN
UNKNOWN
RT_STRING
4087
3.40938
608
UNKNOWN
UNKNOWN
RT_STRING
4088
3.31153
1116
UNKNOWN
UNKNOWN
RT_STRING
4089
3.33977
1036
UNKNOWN
UNKNOWN
RT_STRING
4090
3.36723
724
UNKNOWN
UNKNOWN
RT_STRING
4091
3.33978
184
UNKNOWN
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
kernel32.dll (delay-loaded)
netapi32.dll
oleaut32.dll
user32.dll
version.dll

Exports

Title
Ordinal
Address
dbkFCallWrapperAddr
1
0x000BE63C
__dbk_fcall_wrapper
2
0x0000D0A0
TMethodImplementationIntercept
3
0x00054060
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
22
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start embridge.exe embridge.tmp no specs embridge.exe embridge.tmp cmd.exe no specs embridge.exe embridge.exe embridge.exe cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
872"C:\Windows\System32\cmd.exe" /C CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbweC:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1252"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26770/ user=EveryoneC:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1696"C:\Windows\System32\cmd.exe" /C netsh http add sslcert ipport=0.0.0.0:26770 appid= {a38aa4bd-f42d-44fa-a9c9-da61f74ca666} certhash="62c822907a111a65a1a3ad0aa72e722d1c0f6663"C:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1700netsh http add urlacl url=https://+:26770/ user=EveryoneC:\Windows\system32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\credui.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
1784"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=https://+:26769/ user=EveryoneC:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
2156"C:\Users\admin\AppData\Local\Temp\is-J0M3A.tmp\emBridge.tmp" /SL5="$1401B6,5966789,780800,C:\Users\admin\AppData\Local\Temp\emBridge.exe" /SPAWNWND=$90128 /NOTIFYWND=$4017A C:\Users\admin\AppData\Local\Temp\is-J0M3A.tmp\emBridge.tmp
emBridge.exe
User:
admin
Company:
eMudhra Limited
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-j0m3a.tmp\embridge.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
2184"C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26769C:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2508netsh http dele sslcert ipport=0.0.0.0:26769C:\Windows\system32\netsh.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2536"C:\Users\admin\AppData\Local\Temp\is-02VK7.tmp\emBridge.tmp" /SL5="$4017A,5966789,780800,C:\Users\admin\AppData\Local\Temp\emBridge.exe" C:\Users\admin\AppData\Local\Temp\is-02VK7.tmp\emBridge.tmp—emBridge.exe
User:
admin
Company:
eMudhra Limited
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-02vk7.tmp\embridge.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2612"C:\Windows\System32\cmd.exe" /C netsh http dele sslcert ipport=0.0.0.0:26770C:\Windows\System32\cmd.exe—emBridge.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 806
Read events
11 429
Write events
371
Delete events
6

Modification events

(PID) Process:(2156) emBridge.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6C080000CA63D2D9C403D801
(PID) Process:(2156) emBridge.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
D9348B89802CAEA9C432552782D424C15AE5A7BCBAF30C7DDBC61F56A2AC9B73
(PID) Process:(2156) emBridge.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2156) emBridge.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\eMudhra\emBridge\emBridge.exe
(PID) Process:(2156) emBridge.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
73BE0D991990609C20BA1F36688B84B9727D9D3671F29CBA16824F7E2C5DA035
(PID) Process:(2156) emBridge.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2
Operation:writeName:(default)
Value:
(PID) Process:(2156) emBridge.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
Operation:writeName:Enabled
Value:
(PID) Process:(2156) emBridge.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server
Operation:writeName:DisabledByDefault
Value:
0
(PID) Process:(2156) emBridge.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
Operation:writeName:Enabled
Value:
(PID) Process:(2156) emBridge.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
Operation:writeName:DisabledByDefault
Value:
0
Executable files
22
Suspicious files
5
Text files
5
Unknown types
11

Dropped files

PID
Process
Filename
Type
3008emBridge.exeC:\Users\admin\AppData\Local\Temp\is-J0M3A.tmp\emBridge.tmpexecutable
MD5:—
SHA256:—
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\emBridge.exeexecutable
MD5:—
SHA256:—
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\is-9MA71.tmpexecutable
MD5:—
SHA256:—
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\unins000.exeexecutable
MD5:—
SHA256:—
3144emBridge.exeC:\Users\admin\AppData\Local\Temp\is-02VK7.tmp\emBridge.tmpexecutable
MD5:—
SHA256:—
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\is-NNCKH.tmpexecutable
MD5:—
SHA256:—
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\is-UTJ6A.tmpexecutable
MD5:C724ACF1B7F9D029C35F80315D3E340A
SHA256:EC2C36C86514579E8E960724C9D5FDE2793F4FD68BED503B62F2C580B96D863C
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\is-KN06F.tmpexecutable
MD5:C0673BFB50E597A571C63F5DACF720CA
SHA256:E324586890F7C70AC593C3C45D7C607B39B21822C5EF44E3D6FB0F1F57920858
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\System.Web.Http.dllexecutable
MD5:BDC52F53AE7BBD99D60CDC2156F27BD3
SHA256:EA4C2C88771AD1FAB8C1772B75FC9B16162AFD94596FF92905D9741047F75C9B
2156emBridge.tmpC:\Program Files\eMudhra\emBridge\System.Net.Http.Formatting.dllexecutable
MD5:C0673BFB50E597A571C63F5DACF720CA
SHA256:E324586890F7C70AC593C3C45D7C607B39B21822C5EF44E3D6FB0F1F57920858
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
7
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3832
emBridge.exe
GET
200
13.234.80.198:80
http://resources.emudhra.com/hs/updates.xml
IN
text
1.14 Kb
suspicious
3832
emBridge.exe
GET
200
104.18.30.182:80
http://emudhra.ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOOmC2H0WF3YELCqGsqHJengV18gQU6hccABH%2BMkOiwFM6owOKyrAEEokCEHgSV%2BJobjSYo31vc93pcNc%3D
US
der
471 b
whitelisted
3832
emBridge.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQDIWdDD04YvTP7eE%2BWZKH3B
US
der
728 b
whitelisted
3832
emBridge.exe
GET
200
91.199.212.52:80
http://emudhra.crt.sectigo.com/eMudhraRSADomainValidationSecureServerCA.crt
GB
der
1.54 Kb
whitelisted
3832
emBridge.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2d52618f992c1e96
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3832
emBridge.exe
13.234.80.198:80
resources.emudhra.com
Amazon.com, Inc.
IN
suspicious
3832
emBridge.exe
91.199.212.52:80
emudhra.crt.sectigo.com
Comodo CA Ltd
GB
suspicious
3832
emBridge.exe
104.18.30.182:80
ocsp.usertrust.com
Cloudflare Inc
US
suspicious
3832
emBridge.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
resources.emudhra.com
  • 13.234.80.198
suspicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
emudhra.crt.sectigo.com
  • 91.199.212.52
whitelisted
ocsp.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
emudhra.ocsp.sectigo.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted

Threats

No threats detected
Process
Message
emBridge.exe
Topshelf.HostFactory Information: 0 :
emBridge.exe
Configuration Result: [Success] Name emBridge [Success] DisplayName emBridge Service [Success] Description emBridge Service. [Success] ServiceName emBridge
emBridge.exe
Topshelf.HostConfigurators.HostConfiguratorImpl Information: 0 :
emBridge.exe
Topshelf v3.3.154.0, .NET Framework v4.0.30319.34209
emBridge.exe
Topshelf.Runtime.Windows.HostInstaller Information: 0 :
emBridge.exe
Installing emBridge Service service
emBridge.exe
Topshelf.HostFactory Information: 0 :
emBridge.exe
Configuration Result: [Success] Name emBridge [Success] DisplayName emBridge Service [Success] Description emBridge Service. [Success] ServiceName emBridge
emBridge.exe
Topshelf.HostConfigurators.HostConfiguratorImpl Information: 0 :
emBridge.exe
Topshelf v3.3.154.0, .NET Framework v4.0.30319.34209
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
emBridge.exe