Edit tour

Windows Analysis Report
GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe

Overview

General Information

Sample name:	GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe
Analysis ID:	1430937
MD5:	fd2c102f6b2dac90179d7981dc7299e1
SHA1:	36b30f7173dae7c450e24204cd432b122121ebb3
SHA256:	4627b4f84258eede9176028143c17f0ef56d649b4ff4ba4d218a2609bf0193f5
Infos:

Detection

Score:	27
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	19
Range:	0 - 100

Signatures

Installs a global event hook (focus changed)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

DLL planting / hijacking vulnerabilities found

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64_ra

GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe (PID: 7032 cmdline: "C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe" MD5: FD2C102F6B2DAC90179D7981DC7299E1)

Grammarly.Desktop.exe (PID: 7104 cmdline: "C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe" new-version-v2 onboarding MD5: 091A781339910425916ACC6BE9750128)

explorer.exe (PID: 4380 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

msedge.exe (PID: 6264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=A0ej0vpdcBiI-yz3QBpBBJwbh5pbNmPvz1dsC4zUlqs&verify=j4bHc&showSuccessState=true MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2612 --field-trial-handle=2044,i,6870177471301933371,15639429936319785931,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7356 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7364 --field-trial-handle=2044,i,6870177471301933371,15639429936319785931,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7468 --field-trial-handle=2044,i,6870177471301933371,15639429936319785931,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=2044,i,6870177471301933371,15639429936319785931,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedgewebview2.exe (PID: 4732 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=7104.3668.17407409699958160167 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 2216 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7fff1e618e88,0x7fff1e618e98,0x7fff1e618ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 1596 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 5980 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1980 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 7064 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2440 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 3924 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1713946862127608 --launch-time-ticks=5472465795 --mojo-platform-channel-handle=3312 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedge.exe (PID: 2268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=A0ej0vpdcBiI-yz3QBpBBJwbh5pbNmPvz1dsC4zUlqs&verify=j4bHc&showSuccessState=true MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2028,i,1723528232903650596,3920355234927745539,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=6qrxDAzOWbV4ISaXbaeblzbqt1-zHDJKTAsNkxFACRE&verify=j4bHc&showSuccessState=true MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=YMT3ROP5autsdjZ_tsNOQAOfNJfh5L4UPzMB0_suXcA&verify=j4bHc&showSuccessState=true MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=DedXj_1j5KNl-qml7Yln6Y4k7TpJCcoTkY4W331meKk&verify=j4bHc&showSuccessState=true MD5: 69222B8101B0601CC6663F8381E7E00F)

tasklist.exe (PID: 7084 cmdline: tasklist /NH /FI "IMAGENAME eq Grammarly.Desktop.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe, ProcessId: 7032, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Grammarly

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	EXE: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	EXE: tasklist.exe
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	EXE: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Uninstall.exe

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-DiffMatchPatch.txt
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-NHotkey.txt
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-NLog.txt
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-NewtonsoftJson.txt
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-Validation.txt
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Legal\License-dotnet.txt

Source: unknown	HTTPS traffic detected: 34.197.163.13:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.231.17.194:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.231.17.194:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.21.223.151:443 -> 192.168.2.16:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.208.47.8:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.22.173.72:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.197.163.13:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.205.78.241:443 -> 192.168.2.16:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.211.23.45:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.73.100.250:443 -> 192.168.2.16:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.235.239.81:443 -> 192.168.2.16:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.235.239.81:443 -> 192.168.2.16:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.154.132.81:443 -> 192.168.2.16:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.235.76.136:443 -> 192.168.2.16:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.3.124.253:443 -> 192.168.2.16:50201 version: TLS 1.2

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File opened: C:\Users\user\AppData\Local\Grammarly

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.183.192.109

Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Windows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Windows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL

Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Mutant created: \Sessions\1\BaseNamedObjects\com.grammarly.ProjectLlama.SingleInstance
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Mutant created: \Sessions\1\BaseNamedObjects\grammarly.desktop.installer-6e9b97a3-dfe7-4a91-afbe-8e51f7be6d6c

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Keyboard.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\DynamicData.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Iterable.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.ExperimentationSDK.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Services.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.WebView.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Utils.PInvoke.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Dependencies.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Security.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\NScurl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.CheetahClient.Protocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Interop.IAccessible2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Batteries.FSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.LegacyCheetahProtocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Dapper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\LanguageExt.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Classic.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Main.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Tracking.GnarClient.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grace.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Classic.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.UI.Onboarding.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.StorageClient.Protocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.FSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.ConfigurationApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.QuillDelta.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.MsOffice.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Serialization.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Mouse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.GrammarlyBusinessApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Parallel.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Reactive.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Gos.Sdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.SDUI.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.TextChecking.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Premium.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.Accessible2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.DesignSystem.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Storage.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\LZStringCSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Batteries.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Utils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.OAuth2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.CoreApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Gnar.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.BusinessMetric.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Application.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.WinEvents.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.UIAutomation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Transforms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Felog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Interop.UIAutomationClient.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Suggestions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Http.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	File created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Experimentation.dll	Jump to dropped file

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Grammarly
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Grammarly

Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Memory allocated: 27D3A450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Memory allocated: 27D52550000 memory reserve \| memory write watch

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970

Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Window / User API: threadDelayed 8585
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Window / User API: threadDelayed 1242

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Keyboard.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\DynamicData.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Iterable.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.ExperimentationSDK.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-arm64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Services.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.WebView.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Utils.PInvoke.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Dependencies.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\NScurl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Security.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.CheetahClient.Protocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Batteries.FSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Interop.IAccessible2Lib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.LegacyCheetahProtocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Dapper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\LanguageExt.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Classic.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Main.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Tracking.GnarClient.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Classic.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grace.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.UI.Onboarding.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Data.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-arm\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.StorageClient.Protocol.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.FSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.QuillDelta.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.ConfigurationApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.MsOffice.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Serialization.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Mouse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.GrammarlyBusinessApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Parallel.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Reactive.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Gos.Sdk.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.SDUI.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.TextChecking.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Premium.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.Accessible2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw156A.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.DesignSystem.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Storage.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\LZStringCSharp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.UI.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Batteries.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Utils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x86\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.OAuth2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.CoreApi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Gnar.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Common.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Application.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.BusinessMetric.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.WinEvents.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\runtimes\win-x64\native\e_sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.UIAutomation.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.SDUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Transforms.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Felog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Interop.UIAutomationClient.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Suggestions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Http.dll	Jump to dropped file
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Experimentation.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe TID: 5504	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe TID: 4872	Thread sleep count: 8585 > 30
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe TID: 4872	Thread sleep count: 1242 > 30

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Default\Code Cache\wasm FullSizeInformation

Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Process created: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe "C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe" new-version-v2 onboarding
Source: C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /NH /FI "IMAGENAME eq Grammarly.Desktop.exe"
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=A0ej0vpdcBiI-yz3QBpBBJwbh5pbNmPvz1dsC4zUlqs&verify=j4bHc&showSuccessState=true
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.grammarly.com/signin/app?client_id=windowsExtension&code_challenge=6qrxDAzOWbV4ISaXbaeblzbqt1-zHDJKTAsNkxFACRE&verify=j4bHc&showSuccessState=true
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7fff1e618e88,0x7fff1e618e98,0x7fff1e618ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=1980 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --mojo-platform-channel-handle=2440 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Roaming\Grammarly\DesktopIntegrations\WebViewUserDataFolder\EBWebView" --webview-exe-name=Grammarly.Desktop.exe --webview-exe-version=1.2.73.1374 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1713946862127608 --launch-time-ticks=5472465795 --mojo-platform-channel-handle=3312 --field-trial-handle=1776,i,2049788337709370666,9571100101711157599,262144 --enable-features=MojoIpcz /prefetch:1
Source: C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	Process created: unknown unknown

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	1 Credential API Hooking	2 Process Discovery	Remote Services	1 Credential API Hooking	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 DLL Search Order Hijacking	1 DLL Side-Loading	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 DLL Search Order Hijacking	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 DLL Search Order Hijacking	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	0%	ReversingLabs
GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Dapper.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Dapper.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\DynamicData.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\DynamicData.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grace.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grace.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.FSharp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.FSharp.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Batteries.FSharp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.CheetahClient.Protocol.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Abstractions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Batteries.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Data.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Diagnostics.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Logging.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Parallel.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Reactive.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Security.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Serialization.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.DesignSystem.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.Accessible2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.MsOffice.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.UIAutomation.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.BusinessMetric.Abstractions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Dependencies.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Experimentation.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Gnar.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Main.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Services.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.UI.Onboarding.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.WebView.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Application.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.SDUI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Suggestions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.Models.Transforms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.QuillDelta.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.SDUI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Domain.TextChecking.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Keyboard.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Mouse.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.Storage.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Env.WinEvents.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.ExperimentationSDK.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Gos.Sdk.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Http.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.LegacyCheetahProtocol.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Logging.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.SDUI.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Auth.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.Common.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.ConfigurationApi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Services.CoreApi.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
win-extension.femetrics.grammarly.io	0%	Virustotal		Browse
f-log-win-extension.grammarly.io	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false		unknown
auth.grammarly.com	23.21.223.151	true	false		high
properties.grammarly.com	3.211.23.45	true	false		high
public-treatment.prod-experimentation.grammarlyaws.com	107.22.173.72	true	false		unknown
f-log-win-extension.grammarly.io	3.231.17.194	true	false	0%, Virustotal, Browse	unknown
gates.grammarly.com	44.205.78.241	true	false		high
us-cds.taboola.com	141.226.224.32	true	false		high
www.grammarly.com	44.212.184.83	true	false		high
win-extension.femetrics.grammarly.io	34.197.163.13	true	false	0%, Virustotal, Browse	unknown
update-windows.grammarly.com	18.154.132.81	true	false		high
app.grammarly.com	44.209.120.59	true	false		high
gnar.grammarly.com	18.208.47.8	true	false		high
denali-static.grammarly.com	18.164.174.95	true	false		high
treatment.grammarly.com	unknown	unknown	false		high
cds.taboola.com	unknown	unknown	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Dapper.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\DynamicData.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\FSharp.Core.xml

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grace.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.FSharp.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Auth.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Batteries.FSharp.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.CheetahClient.Protocol.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Abstractions.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Abstractions.dll.config

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Batteries.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Data.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Data.dll.config

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Diagnostics.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Logging.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Parallel.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Reactive.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Reactive.dll.config

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Security.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Common.Serialization.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.DesignSystem.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.DesignSystem.xml

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.Accessible2.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.MsOffice.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.UIAutomation.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.dll

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.Attachment.dll.config

C:\Users\user\AppData\Local\Grammarly\DesktopIntegrations\Grammarly.Desktop.BusinessMetric.Abstractions.dll

Windows Analysis Report
GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe

IP	Domain	Country	ASN	ASN Name	Malicious
184.73.100.250	unknown	United States	14618	AMAZON-AESUS	false
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.6.158	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.202.153.49	unknown	United States	14618	AMAZON-AESUS	false
216.137.39.47	unknown	United States	16509	AMAZON-02US	false
104.16.117.43	unknown	United States	13335	CLOUDFLARENETUS	false
18.154.142.121	unknown	United States	16509	AMAZON-02US	false
142.250.101.154	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
3.92.120.28	unknown	United States	14618	AMAZON-AESUS	false
151.101.65.140	unknown	United States	54113	FASTLYUS	false
23.219.38.72	unknown	United States	20940	AKAMAI-ASN1EU	false
3.211.23.45	properties.grammarly.com	United States	14618	AMAZON-AESUS	false
23.21.223.151	auth.grammarly.com	United States	14618	AMAZON-AESUS	false
204.79.197.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.164.174.31	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.141.104	unknown	United States	15169	GOOGLEUS	false
44.205.78.241	gates.grammarly.com	United States	14618	AMAZON-AESUS	false
23.3.84.234	unknown	United States	16625	AKAMAI-ASUS	false
52.41.227.71	unknown	United States	16509	AMAZON-02US	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.2.155	unknown	United States	15169	GOOGLEUS	false
34.224.77.76	unknown	United States	14618	AMAZON-AESUS	false
151.101.193.44	unknown	United States	54113	FASTLYUS	false
31.13.70.36	unknown	Ireland	32934	FACEBOOKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
34.235.76.136	unknown	United States	14618	AMAZON-AESUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
44.212.184.83	www.grammarly.com	United States	14618	AMAZON-AESUS	false
34.197.11.42	unknown	United States	14618	AMAZON-AESUS	false
40.76.174.66	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.21.239	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
44.235.175.241	unknown	United States	16509	AMAZON-02US	false
34.235.239.81	unknown	United States	14618	AMAZON-AESUS	false
20.99.186.246	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.42.16	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.118.43	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.183.192.109	unknown	United States	7018	ATT-INTERNET4US	false
23.219.38.40	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.2.148	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.65.44	unknown	United States	54113	FASTLYUS	false
216.239.36.54	unknown	United States	15169	GOOGLEUS	false
18.219.60.11	unknown	United States	16509	AMAZON-02US	false
52.223.40.198	unknown	United States	8987	AMAZONEXPANSIONGB	false
18.208.125.13	unknown	United States	14618	AMAZON-AESUS	false
142.250.141.113	unknown	United States	15169	GOOGLEUS	false
34.200.169.99	unknown	United States	14618	AMAZON-AESUS	false
107.22.173.72	public-treatment.prod-experimentation.grammarlyaws.com	United States	14618	AMAZON-AESUS	false
142.251.2.100	unknown	United States	15169	GOOGLEUS	false
216.137.39.100	unknown	United States	16509	AMAZON-02US	false
23.23.170.89	unknown	United States	14618	AMAZON-AESUS	false
13.107.246.69	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.204.249.220	unknown	United States	16625	AKAMAI-ASUS	false
20.125.62.241	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.154.132.45	unknown	United States	16509	AMAZON-02US	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.21.200	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.197.163.13	win-extension.femetrics.grammarly.io	United States	14618	AMAZON-AESUS	false
18.208.47.8	gnar.grammarly.com	United States	14618	AMAZON-AESUS	false
104.18.37.212	unknown	United States	13335	CLOUDFLARENETUS	false
3.231.17.194	f-log-win-extension.grammarly.io	United States	14618	AMAZON-AESUS	false
52.3.124.253	unknown	United States	14618	AMAZON-AESUS	false
142.251.2.132	unknown	United States	15169	GOOGLEUS	false
162.159.152.17	unknown	United States	13335	CLOUDFLARENETUS	false
18.164.174.95	denali-static.grammarly.com	United States	3	MIT-GATEWAYSUS	false
23.56.109.200	unknown	United States	20940	AKAMAI-ASN1EU	false
3.248.143.215	unknown	United States	16509	AMAZON-02US	false
142.251.2.97	unknown	United States	15169	GOOGLEUS	false
54.88.125.176	unknown	United States	14618	AMAZON-AESUS	false
44.209.120.59	app.grammarly.com	United States	14618	AMAZON-AESUS	false
104.244.42.197	unknown	United States	13414	TWITTERUS	false
52.200.166.19	unknown	United States	14618	AMAZON-AESUS	false
104.244.42.3	unknown	United States	13414	TWITTERUS	false
142.251.2.94	unknown	United States	15169	GOOGLEUS	false
151.101.1.140	unknown	United States	54113	FASTLYUS	false
34.111.113.62	unknown	United States	15169	GOOGLEUS	false
52.22.38.2	unknown	United States	14618	AMAZON-AESUS	false
31.13.70.7	unknown	Ireland	32934	FACEBOOKUS	false
146.75.92.157	unknown	Sweden	30051	SCCGOVUS	false
52.49.83.48	unknown	United States	16509	AMAZON-02US	false
34.198.116.68	unknown	United States	14618	AMAZON-AESUS	false
141.226.224.32	us-cds.taboola.com	Israel	200478	TABOOLA-ASIL	false
34.226.161.161	unknown	United States	14618	AMAZON-AESUS	false
35.244.142.80	unknown	United States	15169	GOOGLEUS	false
34.120.195.249	unknown	United States	15169	GOOGLEUS	false
18.154.132.81	update-windows.grammarly.com	United States	16509	AMAZON-02US	false
146.75.92.84	unknown	Sweden	30051	SCCGOVUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430937
Start date and time:	2024-04-24 11:51:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Sample name:	GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe
Detection:	SUS
Classification:	sus27.winEXE@76/502@39/251
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225888
Entropy (8bit):	6.623785835894481
Encrypted:	false
SSDEEP:
MD5:	73769A3CA63428E06C50D7EAFDD6FF1F
SHA1:	09C3443395F960082586541BD396F6C24FA1F3FA
SHA-256:	79E28A836F6D024C70FEBD0DBF2347B26B11E9B233FE6693B474938679503C43
SHA-512:	8CDC2C19AB905B766691247CA3EE168F1EC85FCEC82924CD77B25F5E45FD0DFB4EBF6C96665055B5BD524A07EDBB9FCEFF0349798030413E2E27942BDBEDB283
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|.j..........." ..0..@..........2^... ...`....... ....................................`..................................]..O....`..d............J..`(..........x...p............................................ ............... ..H............text...8>... ...@.................. ..`.rsrc...d....`.......B..............@..@.reloc...............H..............@..B.................^......H........&................................................................(R.....(R...^.(R..........%...}....:.(R.....}....:.(R.....}....:.(R.....}....V!.........sS..........(R...:.(R.....}......{......(R.....(R......0...........u....,..s.............Z.(....uA...%-.&o......{......{......{......{....2.{....sT...2.(....._...2.(....._.....{....2.(....._....0..O.........}......}......}.......}..........(U...-..(....+...(V...}.......}.......}....R.,.(#...

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58057
Entropy (8bit):	6.10612944031567
Encrypted:	false
SSDEEP:
MD5:	81D0F75F2FC5ECBA5E7D80765CF5EF14
SHA1:	6E3757E6F07AFEB7AE50F6B155826DF90C0226A9
SHA-256:	5AF875807B7EE0BA80CB4EE33803F30B6F9AE159C5AD981EEC2E7D80EDABAF2F
SHA-512:	E0EBF7AE638FF62BA6F303138A3E55398152E2B6A3CC044E7649E528154502E8C1B8A6BA112F086FBED30D3B80C5F3B2DFA5300CAFCAF6197C9B6F4B815BDB4C
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	5.667941006065508
Encrypted:	false
SSDEEP:
MD5:	E8032FF1E06E3EAB00908F9EA0598979
SHA1:	AFB97A7643B9D06B8E679853EEF1D9D6911E063F
SHA-256:	868DFFC2A1EBBA118B1F08F65DA622DF5FAA954F738CBACF511903814CACCCF1
SHA-512:	8BA178B1A9BDC9ED5825D923B85C2A98CBAC3ACB73BBE53D2608C118C167CBDC7429D2554A077F5F3C6B39776A59F52A973383B19E843A84A29EAE2C40A8CDB2
Malicious:	false
Reputation:	unknown
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADJ6nshPHp9TrQm6N6Y2njaEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAF6nMrn6c13Ab5Bt5RWCLncCOgZoYawOOOniyrgxysNAAAAAAOgAAAAAIAACAAAAAVy9xTF3vkHgGMaBroC1ADBc3dZd0yth82Rw5LJQwrcjAAAACBloUjouJtlqai8iu/HyOihMag083x+CjMi3aY8CrW8rAAKbaADJYjZyWUINdsTXdAAAAA1h8as5mn+4e7sPg+BKR897/JVgTzmPoKF+oJp62JiI5ZiEjKJg+5mrUPdDdceL1Kq9CTvmMFvsQXGp2P/vY2+w=="},"uninstall_metrics":{"installation_date2":"1713952333"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":4020,"pseudo_low_entropy_source":2235,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13358425933775001","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999861350676348
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GrammarlyInstaller.ej4bHc8fzjsm8sfmuc7404o2.exe
File size:	18'314'104 bytes
MD5:	fd2c102f6b2dac90179d7981dc7299e1
SHA1:	36b30f7173dae7c450e24204cd432b122121ebb3
SHA256:	4627b4f84258eede9176028143c17f0ef56d649b4ff4ba4d218a2609bf0193f5
SHA512:	f03d0e7a9861ae9eb3c222cd7c9712be018c672b185f73444c973e02d1b603cccf593b71caf16a9c9b165c3232f21198dabfc2ab6ed9bd5369d2a52b6dfd17bc
SSDEEP:	393216:SYVjSvFo197p6SzmhRRNGbxr30XA2x/60tXzAV2sMjL:SYVmSn0SzmhnAbxr3CAI/K2skL
TLSH:	C70733389F59EC32E460CB765BF8C8AAF5091C26D870347F96A13B1115B606FC9DBA03
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*.....

Entrypoint:	0x403640
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9B1F [Sat Sep 25 21:56:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	61259b55b8912888e90f516ca08dc514

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/06/2023 02:00:00 08/06/2026 01:59:59
Subject Chain	CN="Grammarly, Inc.", OU="Grammarly, Inc.", O="Grammarly, Inc.", L=San Francisco, S=California, C=US
Version:	3
Thumbprint MD5:	F2D497EF480B89D03E177C8C5B464505
Thumbprint SHA-1:	88414119618A8FD78726A2690042F4D349AF0B8F
Thumbprint SHA-256:	7D9A1B3E0DED5AEECE6F73B0488FA241B206AB4DD0D425A3B19CF34C0B2C0E9A
Serial:	03FAAAC80204F9721AC1E44F59CACA7B

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x80f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1174b18	0x2860
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6676	0x6800	6f5abe9eeda26ee84b3c1ed1a6c82001	False	0.6568134014423077	data	6.4174599871908855	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	8c5edfd8ff9cc0135e197611be38ca18	False	0.4498046875	data	5.141066817170598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	4b2421975c21b032f7ea000f5e7f9fbf	False	0.509765625	data	4.110582127654237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x22000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x80f8	0x8200	d0d5ba30cb532675c40785584eb4fe04	False	0.3800480769230769	data	5.188762161238905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ