File name:

ChromeSetup.exe

Full analysis: https://app.any.run/tasks/dbd07bc6-2eed-485c-a635-e99b9d343596
Verdict: Malicious activity
Analysis date: April 14, 2025, 16:33:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

810287FA15DF6C5CA3204129F706B406

SHA1:

C7C2C8B92CD6DFFB522238D29A8801D4115C619E

SHA256:

03E23CCDE611FC98883EBE219A64230E04D4C1874ED11D097C1291D8D97CC4B4

SSDEEP:

98304:gWWgAN8OG/jc1p1lNRYqhxC9W2pq6vJiUaqk8Nzf/r1KsDdDeu6g5zGJz3f6z1OP:VMwW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • setup.exe (PID: 7512)

  • SUSPICIOUS

    • Application launched itself

      • ChromeSetup.exe (PID: 7640)
      • updater.exe (PID: 7832)
      • updater.exe (PID: 8060)
      • updater.exe (PID: 7932)
      • setup.exe (PID: 7512)
      • setup.exe (PID: 2100)

    • Reads security settings of Internet Explorer

      • ChromeSetup.exe (PID: 7640)
      • updater.exe (PID: 7832)

    • Executable content was dropped or overwritten

      • updater.exe (PID: 7832)
      • updater.exe (PID: 7932)
      • 135.0.7049.85_chrome_installer.exe (PID: 7532)
      • setup.exe (PID: 7512)

    • Executes as Windows Service

      • updater.exe (PID: 7932)
      • updater.exe (PID: 8060)

    • Creates a software uninstall entry

      • setup.exe (PID: 7512)

    • Searches for installed software

      • setup.exe (PID: 7512)

  • INFO

    • Reads the computer name

      • ChromeSetup.exe (PID: 7640)
      • ChromeSetup.exe (PID: 7784)
      • updater.exe (PID: 7832)
      • updater.exe (PID: 7932)
      • updater.exe (PID: 8060)
      • 135.0.7049.85_chrome_installer.exe (PID: 7532)
      • setup.exe (PID: 7512)
      • setup.exe (PID: 2100)

    • The sample compiled with english language support

      • ChromeSetup.exe (PID: 7640)
      • updater.exe (PID: 7832)
      • updater.exe (PID: 7932)
      • 135.0.7049.85_chrome_installer.exe (PID: 7532)
      • setup.exe (PID: 7512)

    • Creates files in the program directory

      • ChromeSetup.exe (PID: 7784)
      • updater.exe (PID: 7852)
      • updater.exe (PID: 7832)
      • updater.exe (PID: 7932)
      • updater.exe (PID: 8060)
      • setup.exe (PID: 7512)
      • setup.exe (PID: 2100)

    • Process checks computer location settings

      • ChromeSetup.exe (PID: 7640)

    • Checks supported languages

      • ChromeSetup.exe (PID: 7640)
      • ChromeSetup.exe (PID: 7784)
      • updater.exe (PID: 7832)
      • updater.exe (PID: 7852)
      • updater.exe (PID: 7932)
      • updater.exe (PID: 7952)
      • updater.exe (PID: 8080)
      • updater.exe (PID: 8060)
      • 135.0.7049.85_chrome_installer.exe (PID: 7532)
      • setup.exe (PID: 7512)
      • setup.exe (PID: 7496)
      • setup.exe (PID: 2100)
      • setup.exe (PID: 5800)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 7832)
      • updater.exe (PID: 7932)
      • updater.exe (PID: 8060)

    • Checks proxy server information

      • updater.exe (PID: 7832)

    • Reads the software policy settings

      • updater.exe (PID: 8060)
      • updater.exe (PID: 7832)

    • Creates files or folders in the user directory

      • updater.exe (PID: 7832)

    • Create files in a temporary directory

      • updater.exe (PID: 7832)

    • Application launched itself

      • chrome.exe (PID: 1056)

    • Executes as Windows Service

      • elevation_service.exe (PID: 6700)

    • Manual execution by a user

      • chrome.exe (PID: 1056)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 7832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:08 03:01:57+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 3664384
InitializedDataSize: 7646720
UninitializedDataSize: -
EntryPoint: 0x1cd530
OSVersion: 10
ImageVersion: -
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 137.0.7115.0
ProductVersionNumber: 137.0.7115.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Installer (x86)
FileVersion: 137.0.7115.0
InternalName: Google Installer (x86)
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
OriginalFileName: UpdaterSetup.exe
ProductName: Google Installer (x86)
ProductVersion: 137.0.7115.0
CompanyShortName: Google
ProductShortName: GoogleUpdater
LastChange: 2a601c83a31cb312ebe3f9e228b32f1e300f9a8c-refs/branch-heads/7115@{#1}
OfficialBuild: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
30
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chromesetup.exe no specs chromesetup.exe updater.exe updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs sppextcomobj.exe no specs slui.exe no specs 135.0.7049.85_chrome_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1056"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installerC:\Program Files\Google\Chrome\Application\chrome.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1300"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2100"C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping8060_896760441\CR_09965.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8060_896760441\CR_09965.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
73
Version:
135.0.7049.85
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping8060_896760441\cr_09965.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2148"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2516"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4408"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=135.0.7049.85 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ffc893f0ca8,0x7ffc893f0cb4,0x7ffc893f0cc0C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
5204"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1996,i,3003663658077494075,7756278347295201421,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.85
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.85\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
4 530
Read events
4 340
Write events
161
Delete events
29

Modification events

(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
Operation:writeName:pv
Value:
137.0.7115.0
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(7932) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}
Operation:delete keyName:(default)
Value:
Executable files
9
Suspicious files
62
Text files
31
Unknown types
0

Dropped files

PID
Process
Filename
Type
7784ChromeSetup.exeC:\Windows\SystemTemp\Google7784_320449721\UPDATER.PACKED.7Z —
MD5:—
SHA256:—
7832updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:6F1ADD8D2A24AD2DB9452BB64ED043E8
SHA256:6B5C5901E33F5C9BDBDAE5EDDAB048D8B701698E327EFB774FEAD1E34142B2F3
7932updater.exeC:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF10ca85.TMPbinary
MD5:90AB3119EF40DCA9AA4301DD86230249
SHA256:316F94D57488D2FCC1B4DF4C72B2C8CCA98DE88816E6400C67300AF1FD401CCF
7932updater.exeC:\Windows\SystemTemp\Google7932_590455680\scoped_dir7932_528137311\GoogleUpdate.exeexecutable
MD5:3AA2C853D6BC7AF7F2F9B8A934943EFD
SHA256:07034876B9EC0B59432B96FEDB7E10E332440159F9802FAAD5F5B99F01885F6B
7832updater.exeC:\Program Files (x86)\Google\GoogleUpdater\137.0.7115.0\uninstall.cmdtext
MD5:FBC297EE9060D4256192E4EDB98CAD1B
SHA256:099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
7932updater.exeC:\Program Files (x86)\Google\Update\GoogleUpdate.exeexecutable
MD5:7E0B8E35886A5E72E469A02A7F2D1CC6
SHA256:CF097F99005B6FD2732C3E429972909C46CE06046F6569784A439A481D1B410B
7832updater.exeC:\Program Files (x86)\Google\GoogleUpdater\prefs.jsonbinary
MD5:90AB3119EF40DCA9AA4301DD86230249
SHA256:316F94D57488D2FCC1B4DF4C72B2C8CCA98DE88816E6400C67300AF1FD401CCF
7932updater.exeC:\Program Files (x86)\Google\GoogleUpdater\prefs.jsonbinary
MD5:2B537F135611617F886653BE6A557C0C
SHA256:6D7A8337E81AF7273FCE68F976C3D7F7EFA58CBB408F9A28B52BFBB22FF6B13B
8060updater.exeC:\Windows\SystemTemp\chrome_url_fetcher_8060_949089424\-8a69d345-d564-463c-aff1-a69d9e530f96-_135.0.7049.85_all_k2h3m242oimh5kxnl55lko4vze.crx3 —
MD5:—
SHA256:—
8060updater.exeC:\Program Files (x86)\Google\GoogleUpdater\crx_cache\388479ce16bd7c2d446ff2a663a31b1fc72c3a7bb9928ad1fa36a71713eb3c2c —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
22
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.189:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7832
updater.exe
GET
200
216.58.206.67:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCaWeNpIFSBzAkvnnFNzwtC
unknown
—
—
whitelisted
7832
updater.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
8060
updater.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome/mtgl4pv3x5mbcrbsdcnc3rctp4_135.0.7049.85/-8a69d345-d564-463c-aff1-a69d9e530f96-_135.0.7049.85_all_k2h3m242oimh5kxnl55lko4vze.crx3
unknown
—
—
whitelisted
7220
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7220
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7832
updater.exe
GET
200
142.250.186.131:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2432
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.189:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8060
updater.exe
142.250.185.195:443
update.googleapis.com
GOOGLE
US
whitelisted
7832
updater.exe
142.250.185.174:443
dl.google.com
GOOGLE
US
whitelisted
7832
updater.exe
142.250.186.131:80
c.pki.goog
GOOGLE
US
whitelisted
7832
updater.exe
216.58.206.67:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.48.23.189
  • 23.48.23.177
  • 23.48.23.134
  • 23.48.23.142
  • 23.48.23.182
  • 23.48.23.178
  • 23.48.23.158
  • 23.48.23.181
  • 23.48.23.151
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
update.googleapis.com
  • 142.250.185.195
whitelisted
dl.google.com
  • 142.250.185.174
whitelisted
c.pki.goog
  • 142.250.186.131
whitelisted
o.pki.goog
  • 216.58.206.67
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.4
  • 40.126.32.74
  • 20.190.160.131
  • 20.190.160.66
  • 20.190.160.2
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ChromeSetup.exe