URL:

http://temp.sh/yYanB/TrayBox.exe

Full analysis: https://app.any.run/tasks/a34edcee-67e4-4e18-a837-5941773375f6
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: December 11, 2023, 05:29:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
babylon
rat
Indicators:
MD5:

E40F665ACB715D5BE275F22364D37BEE

SHA1:

D3B59DCB985A0A72495D68FBE6B0334B7F8959F1

SHA256:

A2DADA9AFF075D0E42ED2937DC0B57C3CB4EF1EFEF4F0C601EE6824B6D7D265A

SSDEEP:

3:N1KKArcETseN:CKReN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TrayBox.exe (PID: 3564)
      • toolbar2179250.exe (PID: 3756)
      • Setup.exe (PID: 3092)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 3092)

    • BABYLON has been detected (SURICATA)

      • Setup.exe (PID: 3092)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 3092)

  • SUSPICIOUS

    • Reads the Internet Settings

      • TrayBox.exe (PID: 3564)
      • Setup.exe (PID: 3092)
      • IELowutil.exe (PID: 4000)
      • rundll32.exe (PID: 1296)
      • rundll32.exe (PID: 1496)
      • rundll32.exe (PID: 2004)
      • rundll32.exe (PID: 3540)
      • rundll32.exe (PID: 1432)
      • rundll32.exe (PID: 3928)

    • Uses RUNDLL32.EXE to load library

      • Setup.exe (PID: 3092)

    • Changes the Home page of Internet Explorer

      • Setup.exe (PID: 3092)

    • Reads Internet Explorer settings

      • Setup.exe (PID: 3092)

    • Changes the title of the Internet Explorer window

      • Setup.exe (PID: 3092)

    • Reads Microsoft Outlook installation path

      • Setup.exe (PID: 3092)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3856)
      • TrayBox.exe (PID: 3564)
      • toolbar2179250.exe (PID: 3756)
      • Setup.exe (PID: 3092)
      • ExpressFiles.exe (PID: 4020)
      • IELowutil.exe (PID: 4000)
      • wmpnscfg.exe (PID: 3532)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3856)
      • TrayBox.exe (PID: 3564)
      • Setup.exe (PID: 3092)
      • IELowutil.exe (PID: 4000)
      • wmpnscfg.exe (PID: 3532)

    • Application launched itself

      • iexplore.exe (PID: 3048)
      • msedge.exe (PID: 3632)
      • msedge.exe (PID: 1616)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3048)
      • TrayBox.exe (PID: 3564)

    • Create files in a temporary directory

      • TrayBox.exe (PID: 3564)
      • toolbar2179250.exe (PID: 3756)
      • Setup.exe (PID: 3092)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3856)
      • msedge.exe (PID: 1616)
      • wmpnscfg.exe (PID: 3532)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3048)
      • iexplore.exe (PID: 2632)

    • Creates files in the program directory

      • TrayBox.exe (PID: 3564)
      • Setup.exe (PID: 3092)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 3092)

    • Checks proxy server information

      • rundll32.exe (PID: 1296)
      • Setup.exe (PID: 3092)
      • IELowutil.exe (PID: 4000)
      • rundll32.exe (PID: 2004)
      • rundll32.exe (PID: 1432)
      • rundll32.exe (PID: 3928)
      • rundll32.exe (PID: 1496)
      • rundll32.exe (PID: 3540)

    • Process checks are UAC notifies on

      • Setup.exe (PID: 3092)

    • Reads the machine GUID from the registry

      • IELowutil.exe (PID: 4000)
      • Setup.exe (PID: 3092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
85
Monitored processes
44
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs traybox.exe no specs traybox.exe toolbar2179250.exe no specs #BABYLON setup.exe msedge.exe no specs msedge.exe no specs expressfiles.exe no specs rundll32.exe no specs ielowutil.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1248 --field-trial-handle=1284,i,5330794418276475840,17237307614409558896,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296rundll32.exe C:\Users\admin\AppData\Local\Temp\BEFD95~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache URI|http://babylon.comC:\Windows\System32\rundll32.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1432rundll32.exe C:\Users\admin\AppData\Local\Temp\BEFD95~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache trkInfo|http://babylon.comC:\Windows\System32\rundll32.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1496rundll32.exe C:\Users\admin\AppData\Local\Temp\BEFD95~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache trkInfo|http://babylon.comC:\Windows\System32\rundll32.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1528"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3856 --field-trial-handle=1284,i,5330794418276475840,17237307614409558896,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2556 --field-trial-handle=1284,i,5330794418276475840,17237307614409558896,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1616"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate http://express-files.com/welcome/?sid=6-1-c827224-fb65-44a0-a4c6-a000a18419a5-0.2&aid=000&b=0&d=1702272603C:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1784"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3788 --field-trial-handle=1284,i,5330794418276475840,17237307614409558896,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1828"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1284,i,5330794418276475840,17237307614409558896,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1888"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1392,i,16185924839201388651,7959147296302964284,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
20 658
Read events
20 418
Write events
226
Delete events
14

Modification events

(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3048) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
24
Suspicious files
174
Text files
99
Unknown types
1

Dropped files

PID
Process
Filename
Type
2632iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab2CE.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\TrayBox[1].htmhtml
MD5:BD2695F4B079C71DBDDDE3436286FB9C
SHA256:2E04A18FF185BA5B16F762A0538339BC4049ACEAEF9738EDD43AF77D2CEB788B
3048iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2632iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\976C9CADC0C46D8FD0AE95B7FD603711binary
MD5:36CE24C95163D4B17572659CE803CEA0
SHA256:C756B1EBBB772CCF356755AAA3204EFE9567892DB65D40BA6455F2B564033FD3
3048iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:DC2EAB6954967172EE4582DD4B849284
SHA256:5B11C124D82AD513BAED39946B2B429CFBEA5A12862F8815AECCF8D0D9CBF142
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\TrayBox[1].htmhtml
MD5:4D9D24DF2494F31C736BC6EB6C63DDF4
SHA256:C94C78A09894F9780F2E4595EB8FA79C07041E2E1ACA06A31134A5B42183F919
3048iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:21C5FBF89BDD9E592DB44F37264236CD
SHA256:40C43F6AAEC909DAEE25EBA0146B72B1681EDD36FD92EE33F9A9DD7F39547676
3048iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2632iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TrayBox.exe.t1nazoz.partialexecutable
MD5:4D32FA0EE0E0BF3E02F9C951B62F10D1
SHA256:31C5CFA7A0F0A0632B3C4B9EDEC97C1644D992FC6B16A7E772D09AD8F73C3C70
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
60
DNS requests
65
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2632
iexplore.exe
GET
301
51.91.79.17:80
http://temp.sh/yYanB/TrayBox.exe
unknown
html
178 b
unknown
2632
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6a3142f400022d08
unknown
compressed
4.66 Kb
unknown
2632
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e13d3df8d960b322
unknown
compressed
65.2 Kb
unknown
2632
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
2632
iexplore.exe
GET
200
23.53.40.161:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSm1yjZhpZje6H38V0SxAILMA%3D%3D
unknown
binary
503 b
unknown
3048
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
3048
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3092
Setup.exe
GET
200
184.154.27.235:80
http://info.babylon.com/setup/downloader.php?ver=9.0.3.34&lang=en&sutp=50&sufl=2&wbs=7&dwb=ie&prver=0&iev=9&tbtp=mntr903&tball=1&zpb=1&tbinst=1&geo=1&cntry=US&affilID=109130&&guid={4B862B7B-20D2-45F2-AED6-37821EFA2A02}
unknown
text
274 b
unknown
3048
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
3048
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2632
iexplore.exe
51.91.79.17:80
temp.sh
OVH SAS
FR
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2632
iexplore.exe
51.91.79.17:443
temp.sh
OVH SAS
FR
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2632
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2632
iexplore.exe
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
2632
iexplore.exe
23.53.40.161:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
3048
iexplore.exe
51.91.79.17:443
temp.sh
OVH SAS
FR
unknown

DNS requests

Domain
IP
Reputation
temp.sh
  • 51.91.79.17
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
r3.o.lencr.org
  • 23.53.40.161
  • 23.53.40.154
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 23.37.226.105
  • 23.37.226.97
  • 23.53.43.121
  • 23.53.43.115
  • 23.37.226.106
  • 23.37.226.81
  • 23.53.43.152
  • 23.15.178.226
  • 23.15.178.147
  • 23.37.226.98
  • 104.126.37.178
  • 104.126.37.137
  • 104.126.37.130
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.144
  • 104.126.37.153
  • 104.126.37.131
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.babylon.com
  • 69.175.64.72
unknown
info.babylon.com
  • 184.154.27.235
unknown
express-files.com
  • 127.0.0.1
unknown

Threats

PID
Process
Class
Message
3092
Setup.exe
Potential Corporate Privacy Violation
ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://temp.sh/yYanB/TrayBox.exe