File name:

Google AI Gemini Ultra For PC V1.0.1.msi

Full analysis: https://app.any.run/tasks/0ef391d1-20c0-4279-adb6-e89afe28d37f
Verdict: Malicious activity
Analysis date: February 11, 2024, 22:33:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}, Title: Install, Author: Install, Comments: Bringing the benefits of AI to everyone, Number of Words: 2, Last Saved Time/Date: Mon Jan 22 11:59:18 2024, Last Printed: Mon Jan 22 11:59:18 2024
MD5:

BF17D7F8DAC7DF58B37582CEC39E609D

SHA1:

0C55B3C75E5759EFC6DB20B6DB4FAD790CBCD4E7

SHA256:

BB7C3B78F2784A7AC3C090331326279476C748087188AEB69F431BBD70AC6407

SSDEEP:

24576:C1ipiRvE4wbF60m3oOEZ/vTk1oQ53eYc:C1ipiRM4wbF60m3oOEZ/vTk1oQ53lc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2496)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6444)
    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2940)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 2400)
    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2940)
    • Executes as Windows Service

      • VSSVC.exe (PID: 2584)
    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2940)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2496)
    • The process executes Powershell scripts

      • cmd.exe (PID: 2496)
    • Executing commands from ".cmd" file

      • msiexec.exe (PID: 2940)
    • Reads the date of Windows installation

      • identity_helper.exe (PID: 6780)
  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6336)
      • msiexec.exe (PID: 6456)
      • identity_helper.exe (PID: 6780)
      • identity_helper.exe (PID: 6432)
    • Create files in a temporary directory

      • msiexec.exe (PID: 6336)
      • msiexec.exe (PID: 6456)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 2400)
    • Reads the computer name

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6336)
      • msiexec.exe (PID: 6456)
      • identity_helper.exe (PID: 6432)
      • identity_helper.exe (PID: 6780)
    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2400)
      • chrome.exe (PID: 1728)
    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2940)
    • Creates a software uninstall entry

      • msiexec.exe (PID: 2940)
    • Application launched itself

      • msedge.exe (PID: 4520)
      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 8792)
    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 4520)
      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 8792)
    • Checks proxy server information

      • slui.exe (PID: 4008)
    • Reads the software policy settings

      • slui.exe (PID: 4008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2024:01:22 11:59:18
ModifyDate: 2024:01:22 11:59:18
Words: 2
Comments: Bringing the benefits of AI to everyone
Keywords: -
Author: Install
Subject: -
Title: Install
RevisionNumber: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}
Pages: 200
Template: Intel;1033
CodePage: Windows Latin 1 (Western European)
Security: Password protected
Software: Windows Installer
CreateDate: 1999:06:21 07:00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
66
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs chrome.exe msedge.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs slui.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs filecoauth.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2400"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\Google AI Gemini Ultra For PC V1.0.1.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2940C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6336C:\Windows\syswow64\MsiExec.exe -Embedding 07EEBDA4F52A2DC71B828CF63D181045 CC:\Windows\SysWOW64\msiexec.exemsiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2584C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2588C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:5C:\Windows\System32\SrTasks.exemsiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeSrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6456C:\Windows\syswow64\MsiExec.exe -Embedding 5DD30614F9BF2BEA33B2E5CBA39E9838C:\Windows\SysWOW64\msiexec.exemsiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2496C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\Google\Install\install.cmd""C:\Windows\System32\cmd.exemsiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4252\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6444powershell -ExecutionPolicy Bypass -File "C:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic/ru.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
36 606
Read events
36 070
Write events
506
Delete events
30

Modification events

(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000203AC4773A5DDA017C0B000024130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000203AC4773A5DDA017C0B000024130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000113AE3773A5DDA017C0B000024130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
5
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000916FFD773A5DDA017C0B000024130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000916FFD773A5DDA017C0B0000E00F0000E803000001000000000000000000000083515AD26E251E4894197777F90A20E000000000000000000000000000000000
(PID) Process:(2584) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000BA3802783A5DDA01180A0000A8170000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
12
Suspicious files
144
Text files
154
Unknown types
104

Dropped files

PID
Process
Filename
Type
2940msiexec.exeC:\System Volume Information\SPP\metadata-2
MD5:
SHA256:
2940msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:2E3508E07C551933E37171464100D7A2
SHA256:B9076E39E7177F12E5FEDE029B9090D4E55F28EDEBA9EA0113A17E0C809D8CAB
2940msiexec.exeC:\WINDOWS\TEMP\~DF9BB9E4E81E189EB7.TMPgmc
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
2940msiexec.exeC:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic\background.jstext
MD5:93184C1E02220665A5F9CA7AF9C7E38C
SHA256:7526DA006B81D1ED279828CA66069B83815C13551D8125872306C20B03F60C3F
2940msiexec.exeC:\Program Files (x86)\Google\Install\New Folder #%d2\account_manager (22).xlshtml
MD5:6C5641DC874A47886100A16B2CCC91D9
SHA256:CA63E6F0579499AC87F9AC73D0EF0403022D5474A250D1BD2650288BB0C39BB9
2940msiexec.exeC:\WINDOWS\Installer\MSIA8B9.tmpbinary
MD5:2871BC0BCF55D3F5403D9F70D2AE353B
SHA256:149EA445D50C05D75C155A36B4AE7CF10594F27AD2A05E362FF24C55B0BEE5A6
2940msiexec.exeC:\WINDOWS\TEMP\~DF70B317768FC831D1.TMPbinary
MD5:2E3508E07C551933E37171464100D7A2
SHA256:B9076E39E7177F12E5FEDE029B9090D4E55F28EDEBA9EA0113A17E0C809D8CAB
2940msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d25a5183-256e-481e-9419-7777f90a20e0}_OnDiskSnapshotPropbinary
MD5:28689439DD4644C44D0B20BB41BFA795
SHA256:3F8938D15D86F2B5257CC7C6FA85FD83BD868AF5EC843156E431E349C88DB128
2940msiexec.exeC:\WINDOWS\Installer\MSIA84A.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2940msiexec.exeC:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic\favicon.pngimage
MD5:8BE1FACB79791A064862A61399B6DFEA
SHA256:89FF11A2237F9EC798ED4493738B14BE76F11F282C5AB755847779FE241EF857
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
160
TCP/UDP connections
102
DNS requests
86
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
binary
813 b
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
binary
400 b
5356
SIHClient.exe
GET
304
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
5356
SIHClient.exe
GET
200
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
23.9 Kb
5356
SIHClient.exe
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
binary
401 b
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
binary
555 b
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
svchost.exe
239.255.255.250:1900
unknown
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
unknown
1440
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
unknown
5356
SIHClient.exe
13.85.23.86:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5356
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5356
SIHClient.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5356
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1728
chrome.exe
239.255.255.250:1900
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.223.35.26
unknown
slscr.update.microsoft.com
  • 13.85.23.86
unknown
www.microsoft.com
  • 184.30.21.171
unknown
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
unknown
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
unknown
www.bing.com
  • 95.101.20.162
  • 95.101.20.169
  • 95.101.20.177
  • 95.101.20.176
  • 95.101.20.161
  • 95.101.20.178
  • 95.101.20.168
  • 95.101.20.171
  • 95.101.20.179
unknown
clientservices.googleapis.com
  • 142.250.185.67
unknown
config.edge.skype.com
  • 13.107.42.16
unknown
www.googleapis.com
  • 142.250.184.202
  • 142.250.181.234
  • 142.250.186.170
  • 142.250.186.74
  • 142.250.186.138
  • 142.250.74.202
  • 142.250.186.42
  • 172.217.18.10
  • 142.250.186.106
  • 172.217.16.202
  • 216.58.206.42
  • 172.217.18.106
  • 172.217.23.106
  • 216.58.212.138
  • 142.250.185.74
  • 142.250.184.234
unknown
clients2.google.com
  • 142.250.186.142
unknown

Threats

No threats detected
No debug info