We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
11 February 2024, 22:33
Analysis environment:
Windows 10 Pro, build 19044, x64
Google AI Gemini Ultra For PC V1.0.1.msi
MD5:
BF17D7F8DAC7DF58B37582CEC39E609D
SHA1:
0C55B3C75E5759EFC6DB20B6DB4FAD790CBCD4E7
SHA256:
BB7C3B78F2784A7AC3C090331326279476C748087188AEB69F431BBD70AC6407
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis Google AI Gemini Ultra For PC V1.0.1.msi (MD5: BF17D7F8DAC7DF58B37582CEC39E609D) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Drops the executable file immediately after the start
msiexec.exe (PID: 2940)
Changes powershell execution policy (Bypass)
cmd.exe (PID: 2496)
Bypass execution policy to execute commands
powershell.exe (PID: 6444)
SUSPICIOUS
Process drops legitimate windows executable
msiexec.exe (PID: 2400)
msiexec.exe (PID: 2940)
Executes as Windows Service
VSSVC.exe (PID: 2584)
Reads the Windows owner or organization settings
msiexec.exe (PID: 2940)
Starts CMD.EXE for commands execution
msiexec.exe (PID: 2940)
Executing commands from ".cmd" file
msiexec.exe (PID: 2940)
Starts POWERSHELL.EXE for commands execution
cmd.exe (PID: 2496)
Reads the date of Windows installation
identity_helper.exe (PID: 6780)
The process executes Powershell scripts
cmd.exe (PID: 2496)
INFO
Reads the computer name
msiexec.exe (PID: 2940)
msiexec.exe (PID: 6336)
msiexec.exe (PID: 6456)
identity_helper.exe (PID: 6780)
identity_helper.exe (PID: 6432)
Checks supported languages
msiexec.exe (PID: 2940)
msiexec.exe (PID: 6336)
msiexec.exe (PID: 6456)
identity_helper.exe (PID: 6780)
identity_helper.exe (PID: 6432)
Drops the executable file immediately after the start
msiexec.exe (PID: 2400)
chrome.exe (PID: 1728)
Create files in a temporary directory
msiexec.exe (PID: 6336)
msiexec.exe (PID: 6456)
Executable content was dropped or overwritten
msiexec.exe (PID: 2400)
msiexec.exe (PID: 2940)
Creates files or folders in the user directory
msiexec.exe (PID: 2940)
Creates a software uninstall entry
msiexec.exe (PID: 2940)
Application launched itself
msedge.exe (PID: 4520)
chrome.exe (PID: 1728)
msedge.exe (PID: 8792)
Reads Microsoft Office registry keys
msedge.exe (PID: 4520)
chrome.exe (PID: 1728)
msedge.exe (PID: 8792)
Checks proxy server information
slui.exe (PID: 4008)
Reads the software policy settings
slui.exe (PID: 4008)
Threats
No threats detected