File name:

Grass_4.28.2_x64-setup.exe

Full analysis: https://app.any.run/tasks/07c33f55-1a36-4291-af79-97042b76f9bf
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 12, 2024, 22:24:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

56AE67365E68296A0F2EB10DFD59E025

SHA1:

61288C763DF5787997365BF7024CD74B513B64FE

SHA256:

9BF268F41BF5372F7E2A1592E782DF97E4686084218110DF330CAF08B829B442

SSDEEP:

98304:wJ8/X5Lx3TdWpssbMPIbMip9KRHm93qniT/k6vq+XZwrI36Je9cm8fcoS+SWdxd+:w/x42FpLIv+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Grass_4.28.2_x64-setup.exe (PID: 2588)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4676)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Grass_4.28.2_x64-setup.exe (PID: 2588)

    • The process creates files with name similar to system file names

      • Grass_4.28.2_x64-setup.exe (PID: 2588)

    • Potential Corporate Privacy Violation

      • Grass_4.28.2_x64-setup.exe (PID: 2588)

    • Process requests binary or script from the Internet

      • Grass_4.28.2_x64-setup.exe (PID: 2588)

    • Process drops legitimate windows executable

      • Grass_4.28.2_x64-setup.exe (PID: 2588)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4676)
      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 4676)
      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 3700)

  • INFO

    • Checks supported languages

      • Grass_4.28.2_x64-setup.exe (PID: 2588)
      • MicrosoftEdgeWebview2Setup.exe (PID: 4676)
      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Create files in a temporary directory

      • Grass_4.28.2_x64-setup.exe (PID: 2588)

    • Reads the computer name

      • Grass_4.28.2_x64-setup.exe (PID: 2588)
      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Checks proxy server information

      • Grass_4.28.2_x64-setup.exe (PID: 2588)
      • MicrosoftEdgeUpdate.exe (PID: 3700)
      • wermgr.exe (PID: 7044)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 4676)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 3700)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 3700)
      • wermgr.exe (PID: 7044)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.28.2.0
ProductVersionNumber: 4.28.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: -
FileVersion: 4.28.2
LegalCopyright: © Grass Foundation, 2024. All rights reserved.
ProductName: Grass
ProductVersion: 4.28.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start grass_4.28.2_x64-setup.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe explorer.exe no specs COpenControlPanel no specs grass_4.28.2_x64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2588"C:\Users\admin\AppData\Local\Temp\Grass_4.28.2_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\Grass_4.28.2_x64-setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Version:
4.28.2
Modules
Images
c:\users\admin\appdata\local\temp\grass_4.28.2_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3700"C:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.31
Modules
Images
c:\program files (x86)\microsoft\temp\eudbf.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4676C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Grass_4.28.2_x64-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.31
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5196C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
5640C:\WINDOWS\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
7044"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "3700" "1804" "724" "2052" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7088"C:\Users\admin\AppData\Local\Temp\Grass_4.28.2_x64-setup.exe" C:\Users\admin\AppData\Local\Temp\Grass_4.28.2_x64-setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
4.28.2
Modules
Images
c:\users\admin\appdata\local\temp\grass_4.28.2_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
7 069
Read events
7 007
Write events
59
Delete events
3

Modification events

(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{E02ED9F8-417C-4F48-A5A0-7FCABD7DFE85}
Operation:writeName:PersistedPingString
Value:
<?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.31" shell_version="1.3.147.37" ismachine="1" sessionid="{2CDA1394-3004-46BC-9340-D3B5A634689C}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="otherinstallcmd" requestid="{E02ED9F8-417C-4F48-A5A0-7FCABD7DFE85}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag="&quot;r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=&quot;"/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.185.17" nextversion="1.3.195.31" lang="" brand="" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="5953340611" install_time_ms="454"/></app></request>
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{E02ED9F8-417C-4F48-A5A0-7FCABD7DFE85}
Operation:writeName:PersistedPingTime
Value:
133759238879120405
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{E02ED9F8-417C-4F48-A5A0-7FCABD7DFE85}
Operation:delete keyName:(default)
Value:
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{6973c978-408c-5015-2d02-5a46779b6fcf}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:\REGISTRY\A\{6973c978-408c-5015-2d02-5a46779b6fcf}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(7044) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
B1D5336700000000
(PID) Process:(7044) wermgr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
8B1B090000000000
(PID) Process:(3700) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings
Operation:writeName:setup_lock_acquire_ms
Value:
0300000000000000000000000000000000000000000000000000000000000000
Executable files
204
Suspicious files
8
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2588Grass_4.28.2_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nseD0D8.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
2588Grass_4.28.2_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nseD0D8.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
2588Grass_4.28.2_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nseD0D8.tmp\modern-wizard.bmpimage
MD5:35294D23C7AD734CF72E51A6265DE20F
SHA256:BD1B474C41C064F8116619D6ADA8653FD5EA3E544C62F53755011F2012EBFE76
4676MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:35A79BD6DE650D2C0988674344BF698B
SHA256:A79A81DA2B8DCBE39609A9E1B4E8C81AE0BC54195C0C854B77BEBE7BFA7F10C1
2588Grass_4.28.2_x64-setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:431A51D6443439E7C3063C36E18E87D6
SHA256:726732C59F91424E8FB9280C1E773E1DB72C8607AD110113BC62C67C452154A6
4676MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:6D805602CA06ADC5AE7464F47E654C28
SHA256:4DAD1176E59A3DB12D134252C4560F75EC907177CDE71389D2B44F245CCDE8F5
4676MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:389D2A20B0F815635B305D01BF6B0FA5
SHA256:3266E7D613DFABB542F67D6753E3506BF1229559EC093A1D8ADDB2BC5B5EB7F8
4676MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\msedgeupdate.dllexecutable
MD5:39AC5A029F87748E964491B97936D890
SHA256:BA861524FE648CCB47B7AC57421BB07A6231A7AAB5EAEA332548511CCE6185BC
2588Grass_4.28.2_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nseD0D8.tmp\NSISdl.dllexecutable
MD5:EE68463FED225C5C98D800BDBD205598
SHA256:419485A096BC7D95F872ED1B9B7B5C537231183D710363BEEE4D235BB79DBE04
4676MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUDBF.tmp\psuser_64.dllexecutable
MD5:0EE07EE9B65A85DFD22A8B5D7488C7BD
SHA256:32CB22AC25721131E72C2213A107ED1EE9B7B2E8EDAAB3E6A4EC80E45A291DB4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
66
DNS requests
32
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2588
Grass_4.28.2_x64-setup.exe
GET
301
184.28.89.167:80
http://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
whitelisted
4376
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2588
Grass_4.28.2_x64-setup.exe
GET
200
152.199.21.175:80
http://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/a81fb0da-2535-485a-a555-a665473e497e/MicrosoftEdgeWebview2Setup.exe
unknown
—
—
whitelisted
7044
wermgr.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7044
wermgr.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
2.23.209.185:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.23.209.185
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.149
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.179
  • 104.126.37.147
  • 104.126.37.137
  • 104.126.37.136
  • 104.126.37.130
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.43
  • 2.16.164.18
  • 2.16.164.9
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.142
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.2
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
th.bing.com
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.187
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.149
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted

Threats

PID
Process
Class
Message
2588
Grass_4.28.2_x64-setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Grass_4.28.2_x64-setup.exe