File name:

Google AI Gemini Ultra For PC V1.0.1.msi

Full analysis: https://app.any.run/tasks/0ef391d1-20c0-4279-adb6-e89afe28d37f
Verdict: Malicious activity
Analysis date: February 11, 2024, 22:33:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 07:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}, Title: Install, Author: Install, Comments: Bringing the benefits of AI to everyone, Number of Words: 2, Last Saved Time/Date: Mon Jan 22 11:59:18 2024, Last Printed: Mon Jan 22 11:59:18 2024
MD5:

BF17D7F8DAC7DF58B37582CEC39E609D

SHA1:

0C55B3C75E5759EFC6DB20B6DB4FAD790CBCD4E7

SHA256:

BB7C3B78F2784A7AC3C090331326279476C748087188AEB69F431BBD70AC6407

SSDEEP:

24576:C1ipiRvE4wbF60m3oOEZ/vTk1oQ53eYc:C1ipiRM4wbF60m3oOEZ/vTk1oQ53lc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6444)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2496)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2940)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 2400)

    • Executing commands from ".cmd" file

      • msiexec.exe (PID: 2940)

    • The process executes Powershell scripts

      • cmd.exe (PID: 2496)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2496)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 2940)

    • Reads the date of Windows installation

      • identity_helper.exe (PID: 6780)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2584)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2940)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 6336)
      • identity_helper.exe (PID: 6780)
      • identity_helper.exe (PID: 6432)

    • Checks supported languages

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 6336)
      • identity_helper.exe (PID: 6780)
      • identity_helper.exe (PID: 6432)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2940)

    • Create files in a temporary directory

      • msiexec.exe (PID: 6456)
      • msiexec.exe (PID: 6336)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2940)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2400)
      • chrome.exe (PID: 1728)

    • Application launched itself

      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 4520)
      • msedge.exe (PID: 8792)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 4520)
      • chrome.exe (PID: 1728)
      • msedge.exe (PID: 8792)

    • Reads the software policy settings

      • slui.exe (PID: 4008)

    • Checks proxy server information

      • slui.exe (PID: 4008)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2940)
      • msiexec.exe (PID: 2400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (90.2)
.msp | Windows Installer Patch (8.4)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CreateDate: 1999:06:21 07:00:00
Software: Windows Installer
Security: Password protected
CodePage: Windows Latin 1 (Western European)
Template: Intel;1033
Pages: 200
RevisionNumber: {C6C2D440-EA93-4E35-B8C6-83DD50C1613C}
Title: Install
Subject: -
Author: Install
Keywords: -
Comments: Bringing the benefits of AI to everyone
Words: 2
ModifyDate: 2024:01:22 11:59:18
LastPrinted: 2024:01:22 11:59:18
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
66
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs chrome.exe msedge.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs slui.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs filecoauth.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=112.0.5615.50 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88b0baa60,0x7ff88b0baa70,0x7ff88b0baa80C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
112.0.5615.50
1520\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1724"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=111.0.5563.149 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=111.0.1661.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x178,0x7ff88a81b5f8,0x7ff88a81b608,0x7ff88a81b618C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
111.0.1661.62
1728"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Program Files (x86)\Google\Install\nmmhkkegccagdldgiimedpic" --new-window https://www.bing.com/images/create C:\Program Files\Google\Chrome\Application\chrome.exe
powershell.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
112.0.5615.50
2400"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\Google AI Gemini Ultra For PC V1.0.1.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
2496C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\Google\Install\install.cmd""C:\Windows\System32\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2584C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2588C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:5C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2940C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
3504"C:\Program Files (x86)\Microsoft\Edge\Application\111.0.1661.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4012 --field-trial-handle=1988,i,5543273393830092669,16467123026098477353,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\111.0.1661.62\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
111.0.1661.62
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
12
Suspicious files
144
Text files
154
Unknown types
104

Dropped files

PID
Process
Filename
Type
2940msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2400msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5B81.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2400msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI5BFF.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
6336msiexec.exeC:\Users\admin\AppData\Local\Temp\CFG5BEE.tmpxml
MD5:68675E0D405C8C76102802FA624EB895
SHA256:B839CDD1C3F55651CD4D0E54A679BCE5AC60ED7618A7B74BFC8EF8CA311E53ED
2940msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d25a5183-256e-481e-9419-7777f90a20e0}_OnDiskSnapshotPropbinary
MD5:28689439DD4644C44D0B20BB41BFA795
SHA256:3F8938D15D86F2B5257CC7C6FA85FD83BD868AF5EC843156E431E349C88DB128
2940msiexec.exeC:\WINDOWS\Installer\MSIA84A.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2940msiexec.exeC:\WINDOWS\Installer\MSIA7FB.tmpexecutable
MD5:B77A2A2768B9CC78A71BBFFB9812B978
SHA256:F74C97B1A53541B059D3BFAFE41A79005CE5065F8210D7DE9F1B600DC4E28AA0
2940msiexec.exeC:\WINDOWS\Installer\MSIA8B9.tmpbinary
MD5:2871BC0BCF55D3F5403D9F70D2AE353B
SHA256:149EA445D50C05D75C155A36B4AE7CF10594F27AD2A05E362FF24C55B0BEE5A6
2940msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:28689439DD4644C44D0B20BB41BFA795
SHA256:3F8938D15D86F2B5257CC7C6FA85FD83BD868AF5EC843156E431E349C88DB128
2940msiexec.exeC:\WINDOWS\TEMP\~DF70B317768FC831D1.TMPbinary
MD5:2E3508E07C551933E37171464100D7A2
SHA256:B9076E39E7177F12E5FEDE029B9090D4E55F28EDEBA9EA0113A17E0C809D8CAB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
160
TCP/UDP connections
102
DNS requests
86
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5356
SIHClient.exe
GET
304
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
—
—
—
5356
SIHClient.exe
GET
200
13.85.23.86:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19044.1288/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.1288&MK=DELL&MD=DELL
unknown
—
23.9 Kb
—
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
binary
401 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
binary
400 b
unknown
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
unknown
5356
SIHClient.exe
GET
200
20.242.39.171:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
5356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
binary
813 b
unknown
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
5356
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
binary
555 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1440
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5356
SIHClient.exe
13.85.23.86:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5356
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5356
SIHClient.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5356
SIHClient.exe
20.242.39.171:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1728
chrome.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 95.101.20.162
  • 95.101.20.169
  • 95.101.20.177
  • 95.101.20.176
  • 95.101.20.161
  • 95.101.20.178
  • 95.101.20.168
  • 95.101.20.171
  • 95.101.20.179
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.googleapis.com
  • 142.250.184.202
  • 142.250.181.234
  • 142.250.186.170
  • 142.250.186.74
  • 142.250.186.138
  • 142.250.74.202
  • 142.250.186.42
  • 172.217.18.10
  • 142.250.186.106
  • 172.217.16.202
  • 216.58.206.42
  • 172.217.18.106
  • 172.217.23.106
  • 216.58.212.138
  • 142.250.185.74
  • 142.250.184.234
whitelisted
clients2.google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Google AI Gemini Ultra For PC V1.0.1.msi