File name:

Token-Grabber-Builder-master.zip

Full analysis: https://app.any.run/tasks/c14200c8-1a7a-451b-8b85-ed11012b3dd0
Verdict: Malicious activity
Analysis date: February 13, 2022, 10:00:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

945332DEB05856B3BBB8264C71895E3E

SHA1:

8BE40DA147243B5628AF3988254F53666FB58956

SHA256:

19F3B2CA31B3947537208F640E31A3CF29B1898A03E2B950926A3163DF18619A

SSDEEP:

768:U6AMCDkppk7RV/BIRb/gBQ1p9nhTn84GN7GBSAl7wU9g7rJppn+DM0RkouCol71G:ZC9qRTgB6nNYuNl7wU96rJpFakouFr3y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • winzip26-bing.exe (PID: 3932)
      • winzip26-bing.exe (PID: 736)
      • winzip26-bing.exe (PID: 3812)
      • FAHWindow32.exe (PID: 3044)
      • adxregistrator.exe (PID: 3836)
      • WzCABCacheSyncHelper32.exe (PID: 2720)
      • FAHConsole.exe (PID: 1424)
      • CloseFAH.exe (PID: 2324)
      • WzPreloader.exe (PID: 2796)
      • adxregistrator.exe (PID: 3304)
      • WzPreviewer32.exe (PID: 3792)
      • WZUpdateNotifier.exe (PID: 2572)
      • WzBGTComServer32.exe (PID: 348)
      • WzBGTools32.exe (PID: 3508)

    • Drops executable file immediately after starts

      • winzip26-bing.exe (PID: 3932)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2372)

    • Changes settings of System certificates

      • MsiExec.exe (PID: 1176)

    • Writes to a start menu file

      • msiexec.exe (PID: 2372)

    • Loads dropped or rewritten executable

      • winzip32.exe (PID: 1808)
      • WzCABCacheSyncHelper32.exe (PID: 2720)
      • csrss.exe (PID: 668)
      • svchost.exe (PID: 876)
      • msiexec.exe (PID: 2372)
      • FAHWindow32.exe (PID: 3044)
      • adxregistrator.exe (PID: 3836)
      • MsiExec.exe (PID: 1176)

    • Runs injected code in another process

      • FAHWindow32.exe (PID: 3044)

    • Application was injected by another process

      • Explorer.EXE (PID: 612)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 3004)
      • schtasks.exe (PID: 3944)

    • Uses Task Scheduler to run other applications

      • MsiExec.exe (PID: 3260)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • Explorer.EXE (PID: 612)

    • Starts Internet Explorer

      • rundll32.exe (PID: 492)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 1492)
      • iexplore.exe (PID: 1344)
      • winzip26-bing.exe (PID: 3812)
      • MsiExec.exe (PID: 1176)
      • winzip32.exe (PID: 1808)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1492)
      • iexplore.exe (PID: 1344)
      • winzip26-bing.exe (PID: 3932)
      • MsiExec.exe (PID: 3260)
      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)

    • Checks supported languages

      • winzip26-bing.exe (PID: 3932)
      • winzip26-bing.exe (PID: 3812)
      • CloseFAH.exe (PID: 2324)
      • WzPreviewer32.exe (PID: 3792)
      • WzPreloader.exe (PID: 2796)
      • winzip32.exe (PID: 1808)
      • WzCABCacheSyncHelper32.exe (PID: 2720)
      • FAHConsole.exe (PID: 1424)
      • FAHWindow32.exe (PID: 3044)
      • adxregistrator.exe (PID: 3836)
      • adxregistrator.exe (PID: 3304)
      • WZUpdateNotifier.exe (PID: 2572)
      • WzBGTComServer32.exe (PID: 348)
      • WzBGTools32.exe (PID: 3508)

    • Starts itself from another location

      • winzip26-bing.exe (PID: 3932)

    • Reads the computer name

      • winzip26-bing.exe (PID: 3812)
      • WzPreloader.exe (PID: 2796)
      • winzip32.exe (PID: 1808)
      • WzCABCacheSyncHelper32.exe (PID: 2720)
      • adxregistrator.exe (PID: 3836)
      • FAHWindow32.exe (PID: 3044)
      • adxregistrator.exe (PID: 3304)
      • WzBGTools32.exe (PID: 3508)

    • Reads internet explorer settings

      • winzip26-bing.exe (PID: 3812)

    • Creates files in the program directory

      • winzip26-bing.exe (PID: 3812)
      • msiexec.exe (PID: 2372)
      • winzip32.exe (PID: 1808)
      • MsiExec.exe (PID: 1176)

    • Executed as Windows Service

      • msiexec.exe (PID: 2372)
      • vssvc.exe (PID: 848)

    • Reads Windows owner or organization settings

      • winzip26-bing.exe (PID: 3812)
      • msiexec.exe (PID: 2372)

    • Searches for installed software

      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)
      • winzip32.exe (PID: 1808)

    • Reads the Windows organization settings

      • winzip26-bing.exe (PID: 3812)
      • msiexec.exe (PID: 2372)

    • Reads Environment values

      • vssvc.exe (PID: 848)
      • WzCABCacheSyncHelper32.exe (PID: 2720)

    • Application launched itself

      • msiexec.exe (PID: 2372)

    • Drops a file that was compiled in debug mode

      • MsiExec.exe (PID: 3260)
      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2372)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 2372)

    • Drops a file with a compile date too recent

      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)

    • Executed via COM

      • DllHost.exe (PID: 3236)

    • Changes IE settings (feature browser emulation)

      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2372)
      • winzip32.exe (PID: 1808)

    • Creates files in the Windows directory

      • MsiExec.exe (PID: 1176)
      • svchost.exe (PID: 876)

    • Adds / modifies Windows certificates

      • MsiExec.exe (PID: 1176)

    • Changes default file association

      • msiexec.exe (PID: 2372)
      • winzip32.exe (PID: 1808)

    • Creates files in the user directory

      • winzip32.exe (PID: 1808)

    • Loads DLL from Mozilla Firefox

      • csrss.exe (PID: 668)

    • Creates/Modifies COM task schedule object

      • winzip32.exe (PID: 1808)
      • adxregistrator.exe (PID: 3836)
      • adxregistrator.exe (PID: 3304)
      • MsiExec.exe (PID: 1176)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 612)

  • INFO

    • Reads the computer name

      • rundll32.exe (PID: 492)
      • iexplore.exe (PID: 1344)
      • iexplore.exe (PID: 1492)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 2372)
      • vssvc.exe (PID: 848)
      • MsiExec.exe (PID: 3260)
      • MsiExec.exe (PID: 1176)
      • DllHost.exe (PID: 3236)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 3004)
      • schtasks.exe (PID: 3944)
      • explorer.exe (PID: 2824)

    • Changes internet zones settings

      • iexplore.exe (PID: 1344)

    • Checks supported languages

      • iexplore.exe (PID: 2764)
      • rundll32.exe (PID: 492)
      • iexplore.exe (PID: 1344)
      • iexplore.exe (PID: 1492)
      • vssvc.exe (PID: 848)
      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 3260)
      • MsiExec.exe (PID: 1176)
      • DllHost.exe (PID: 3236)
      • schtasks.exe (PID: 3944)
      • schtasks.exe (PID: 2896)
      • svchost.exe (PID: 876)
      • schtasks.exe (PID: 3004)
      • explorer.exe (PID: 2824)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 1344)
      • iexplore.exe (PID: 1492)
      • winzip26-bing.exe (PID: 3812)
      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)
      • winzip32.exe (PID: 1808)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1344)
      • iexplore.exe (PID: 1492)
      • iexplore.exe (PID: 2764)
      • winzip26-bing.exe (PID: 3812)
      • msiexec.exe (PID: 2372)
      • MsiExec.exe (PID: 1176)
      • winzip32.exe (PID: 1808)

    • Application launched itself

      • iexplore.exe (PID: 1344)

    • Creates files in the user directory

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 1344)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 1492)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1344)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1344)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1344)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 2372)

    • Reads Microsoft Office registry keys

      • adxregistrator.exe (PID: 3836)
      • adxregistrator.exe (PID: 3304)

    • Manual execution by user

      • explorer.exe (PID: 2824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipFileName: Token-Grabber-Builder-master/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2021:05:13 19:57:19
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
31
Malicious processes
15
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start inject rundll32.exe no specs iexplore.exe iexplore.exe iexplore.exe winzip26-bing.exe no specs winzip26-bing.exe winzip26-bing.exe msiexec.exe vssvc.exe no specs msiexec.exe closefah.exe no specs msiexec.exe DllHost.exe no specs wzpreviewer32.exe no specs wzpreloader.exe no specs winzip32.exe wzcabcachesynchelper32.exe csrss.exe no specs svchost.exe no specs fahconsole.exe no specs fahwindow32.exe no specs adxregistrator.exe no specs adxregistrator.exe no specs explorer.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs wzbgtcomserver32.exe no specs wzupdatenotifier.exe no specs wzbgtools32.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
348"C:\Program Files\WinZip\WzBGTComServer32.exe" /REGSERVERC:\Program Files\WinZip\WzBGTComServer32.exe—msiexec.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
HIGH
Description:
WinZip Background Tool
Exit code:
0
Version:
26.0.14596.0
492"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\AppData\Local\Temp\Token-Grabber-Builder-master.zip.xpi"C:\Windows\system32\rundll32.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
612C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
668%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\system32\csrss.exe——
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
736"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\winzip26-bing.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\winzip26-bing.exe—iexplore.exe
User:
admin
Company:
WinZip Computing
Integrity Level:
MEDIUM
Description:
WinZipStub Installer
Exit code:
3221226540
Version:
26.0.14575.0
848C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1176C:\Windows\system32\MsiExec.exe -Embedding D0058C9A1B434D99242BCF6E9DA789A1 E Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1344"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=xpi"C:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1424"C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe—MsiExec.exe
User:
SYSTEM
Company:
WinZip Computing, S.L.
Integrity Level:
SYSTEM
Description:
File Association Helper
Exit code:
0
Version:
3.0.0.11
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
316
Suspicious files
73
Text files
495
Unknown types
96

Dropped files

PID
Process
Filename
Type
2764iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\G178016G.txttext
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\KP908ZON.txttext
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\B9GZN1CQ.txttext
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\qsml[1].xmlxml
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BY9H7SL8.txttext
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\qsml[1].htmxml
MD5:—
SHA256:—
2764iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\0DO42GBG.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
234
DNS requests
82
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2764
iexplore.exe
GET
301
92.123.224.107:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=xpi%22
unknown
—
—
whitelisted
2764
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2764
iexplore.exe
GET
200
104.18.31.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2764
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2764
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2764
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC0eKdRMTzmwh4ySFgYIPuD
US
der
472 b
whitelisted
2764
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
2764
iexplore.exe
GET
200
65.9.84.221:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2764
iexplore.exe
GET
200
18.66.242.58:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2764
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2764
iexplore.exe
104.89.38.104:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
2764
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2764
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2764
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2764
iexplore.exe
92.123.224.107:80
shell.windows.com
Akamai International B.V.
—
suspicious
2764
iexplore.exe
13.107.5.80:443
api.bing.com
Microsoft Corporation
US
whitelisted
1344
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2764
iexplore.exe
20.190.151.68:443
login.microsoftonline.com
Microsoft Corporation
US
suspicious
2764
iexplore.exe
20.190.160.136:443
login.live.com
Microsoft Corporation
US
suspicious
2764
iexplore.exe
35.227.233.104:443
winrar.en.softonic.com
—
US
malicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 104.89.38.104
  • 104.111.242.51
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
shell.windows.com
  • 92.123.224.107
  • 92.123.224.20
whitelisted
login.microsoftonline.com
  • 20.190.151.68
  • 20.190.151.69
  • 20.190.151.8
  • 20.190.151.132
  • 20.190.151.7
  • 20.190.151.70
  • 20.190.151.67
  • 20.190.151.134
whitelisted
login.live.com
  • 20.190.160.136
  • 20.190.160.73
  • 20.190.160.8
  • 20.190.160.69
  • 20.190.160.67
  • 20.190.160.6
  • 20.190.160.75
  • 20.190.160.132
whitelisted
winrar.en.softonic.com
  • 35.227.233.104
malicious
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted

Threats

PID
Process
Class
Message
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2764
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1176
MsiExec.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
1808
winzip32.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Token-Grabber-Builder-master.zip