analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Google AI Gemini Ultra For PC V1.0.1.msi

Full analysis: https://app.any.run/tasks/0ef391d1-20c0-4279-adb6-e89afe28d37f
Verdict: Malicious activity
Analysis date: February 11, 2024, 22:33:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}, Title: Install, Author: Install, Comments: Bringing the benefits of AI to everyone, Number of Words: 2, Last Saved Time/Date: Mon Jan 22 11:59:18 2024, Last Printed: Mon Jan 22 11:59:18 2024
MD5:

BF17D7F8DAC7DF58B37582CEC39E609D

SHA1:

0C55B3C75E5759EFC6DB20B6DB4FAD790CBCD4E7

SHA256:

BB7C3B78F2784A7AC3C090331326279476C748087188AEB69F431BBD70AC6407

SSDEEP:

24576:C1ipiRvE4wbF60m3oOEZ/vTk1oQ53eYc:C1ipiRM4wbF60m3oOEZ/vTk1oQ53lc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2940)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2496)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6444)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2400)
      • msiexec.exe (PID: 2940)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2940)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2584)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2940)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2496)

    • Executing commands from ".cmd" file

      • msiexec.exe (PID: 2940)

    • Reads the date of Windows installation

      • identity_helper.exe (PID: 6780)

    • The process executes Powershell scripts

      • cmd.exe (PID: 2496)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6336)
      • identity_helper.exe (PID: 6780)
      • identity_helper.exe (PID: 6432)

    • Reads the computer name

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 6336)
      • identity_helper.exe (PID: 6780)
      • identity_helper.exe (PID: 6432)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2400)
      • chrome.exe (PID: 1728)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2940)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 6336)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 2400)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2940)

    • Application launched itself

      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 4520)
      • msedge.exe (PID: 8792)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 4520)
      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 8792)

    • Checks proxy server information

      • slui.exe (PID: 4008)

    • Reads the software policy settings

      • slui.exe (PID: 4008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

LastPrinted: 2024:01:22 11:59:18
ModifyDate: 2024:01:22 11:59:18
Words: 2
Comments: Bringing the benefits of AI to everyone
Keywords: -
Author: Install
Subject: -
Title: Install
RevisionNumber: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}
Pages: 200
Template: Intel;1033
CodePage: Windows Latin 1 (Western European)
Security: Password protected
Software: Windows Installer
CreateDate: 1999:06:21 07:00:00
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
66
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs chrome.exe msedge.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs slui.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs filecoauth.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2400"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\Google AI Gemini Ultra For PC V1.0.1.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2940C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6336C:\Windows\syswow64\MsiExec.exe -Embedding 07EEBDA4F52A2DC71B828CF63D181045 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2584C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2588C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:5C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6456C:\Windows\syswow64\MsiExec.exe -Embedding 5DD30614F9BF2BEA33B2E5CBA39E9838C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2496C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\Google\Install\install.cmd""C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4252\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6444powershell -ExecutionPolicy Bypass -File "C:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic/ru.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
36 606
Read events
36 070
Write events
506
Delete events
30

Modification events

(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000203AC4773A5DDA017C0B000024130000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000203AC4773A5DDA017C0B000024130000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000095D2E0773A5DDA017C0B000024130000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000113AE3773A5DDA017C0B000024130000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
5
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000916FFD773A5DDA017C0B000024130000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2940) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000916FFD773A5DDA017C0B0000E00F0000E803000001000000000000000000000083515AD26E251E4894197777F90A20E000000000000000000000000000000000
(PID) Process:(2584) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000BA3802783A5DDA01180A0000A8170000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
12
Suspicious files
144
Text files
154
Unknown types
104

Dropped files

PID
Process
Filename
Type
2940msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2940msiexec.exeC:\WINDOWS\Installer\inprogressinstallinfo.ipibinary
MD5:2E3508E07C551933E37171464100D7A2
SHA256:B9076E39E7177F12E5FEDE029B9090D4E55F28EDEBA9EA0113A17E0C809D8CAB
2400msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5BFF.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2400msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5B81.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2940msiexec.exeC:\Program Files (x86)\Google\Install\System.Web.DynamicData.Design.dllexecutable
MD5:61FAEFB00A0FDBE21A36D1CF248B21A8
SHA256:3C830BCD8609F932B33BD7B138522348B51D42CB89DD12B4A430F14364E287C3
2940msiexec.exeC:\Program Files (x86)\Google\Install\Microsoft.VisualC.Dllexecutable
MD5:8DF8C5146490DC4E469DDD31CED8A705
SHA256:14F2E8D64BDB5B4FAD83B9D550FE1A39539CAEC3C66B8A6AB5A7995BBDA1A296
6456msiexec.exeC:\Users\admin\AppData\Local\Temp\CFGA83A.tmpxml
MD5:68675E0D405C8C76102802FA624EB895
SHA256:B839CDD1C3F55651CD4D0E54A679BCE5AC60ED7618A7B74BFC8EF8CA311E53ED
2940msiexec.exeC:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic\favicon.pngimage
MD5:8BE1FACB79791A064862A61399B6DFEA
SHA256:89FF11A2237F9EC798ED4493738B14BE76F11F282C5AB755847779FE241EF857
2940msiexec.exeC:\WINDOWS\Installer\MSIA84A.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2940msiexec.exeC:\WINDOWS\Installer\MSIA7FB.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
160
TCP/UDP connections
102
DNS requests
86
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5356
SIHClient.exe
GET
304
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
—
—
—
5356
SIHClient.exe
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
5356
SIHClient.exe
GET
200
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
—
23.9 Kb
—
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
binary
813 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
binary
400 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
binary
401 b
unknown
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
binary
555 b
unknown
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1440
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5356
SIHClient.exe
13.85.23.86:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5356
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5356
SIHClient.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5356
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1728
chrome.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 95.101.20.162
  • 95.101.20.169
  • 95.101.20.177
  • 95.101.20.176
  • 95.101.20.161
  • 95.101.20.178
  • 95.101.20.168
  • 95.101.20.171
  • 95.101.20.179
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.googleapis.com
  • 142.250.184.202
  • 142.250.181.234
  • 142.250.186.170
  • 142.250.186.74
  • 142.250.186.138
  • 142.250.74.202
  • 142.250.186.42
  • 172.217.18.10
  • 142.250.186.106
  • 172.217.16.202
  • 216.58.206.42
  • 172.217.18.106
  • 172.217.23.106
  • 216.58.212.138
  • 142.250.185.74
  • 142.250.184.234
whitelisted
clients2.google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Google AI Gemini Ultra For PC V1.0.1.msi