File name:

ChromeSetup.exe

Full analysis: https://app.any.run/tasks/1a5ae119-2bd7-4955-871a-5534439adb18
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: September 06, 2025, 15:56:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
qrcode
stealer
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

3DFC6483CA6D86ABFB7D1717867D5BBC

SHA1:

FEA635AFAD99F3DBEC73BCA4A5D19D90AD2FE113

SHA256:

BC82D250F7896EAF8F05B3D04F712327B7AF194901FC91DD9683ADD10138A662

SSDEEP:

98304:jhza8RrojQPyIFIY5zlC+UM4v3voB8Y1pbzxj9BNSZUKftSd1LmwfAFWGH4XNXHj:jwltXuIM/pX5cjkJdjOrNGr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • setup.exe (PID: 2728)
      • browser.exe (PID: 7560)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 2064)
      • service_update.exe (PID: 6348)
      • service_update.exe (PID: 1588)
      • csrss.exe (PID: 608)
      • service_update.exe (PID: 4664)
      • csrss.exe (PID: 524)
      • service_update.exe (PID: 6524)
      • service_update.exe (PID: 7592)
      • service_update.exe (PID: 7652)
      • explorer.exe (PID: 7464)
      • clidmgr.exe (PID: 7768)
      • clidmgr.exe (PID: 7832)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 7536)
      • browser.exe (PID: 7552)
      • browser.exe (PID: 7368)
      • browser.exe (PID: 4744)
      • browser.exe (PID: 7404)
      • browser.exe (PID: 5284)
      • browser.exe (PID: 6356)
      • browser.exe (PID: 6412)
      • browser.exe (PID: 7492)
      • browser.exe (PID: 5652)
      • browser.exe (PID: 8072)
      • browser.exe (PID: 7940)
      • browser.exe (PID: 7180)
      • browser.exe (PID: 4520)
      • browser.exe (PID: 864)
      • browser.exe (PID: 8212)
      • browser.exe (PID: 8272)
      • browser.exe (PID: 8512)
      • browser.exe (PID: 2592)
      • browser.exe (PID: 8544)
      • browser.exe (PID: 8568)
      • browser.exe (PID: 8604)
      • browser.exe (PID: 8588)
      • browser.exe (PID: 8596)
      • browser.exe (PID: 8620)
      • browser.exe (PID: 8576)
      • browser.exe (PID: 8532)
      • browser.exe (PID: 8520)
      • browser.exe (PID: 9020)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 9124)
      • browser.exe (PID: 8612)
      • browser.exe (PID: 8504)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 984)
      • browser.exe (PID: 8700)
      • browser.exe (PID: 8760)
      • browser.exe (PID: 8696)
      • browser.exe (PID: 8872)
      • browser.exe (PID: 8944)
      • browser.exe (PID: 8964)
      • browser.exe (PID: 8000)
      • browser.exe (PID: 8208)
      • browser.exe (PID: 8552)
      • browser.exe (PID: 8776)
      • browser.exe (PID: 8488)
      • browser.exe (PID: 4084)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 8908)
      • browser.exe (PID: 3620)
      • browser.exe (PID: 4104)
      • browser.exe (PID: 8620)
      • browser.exe (PID: 8556)
      • browser.exe (PID: 8940)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 7324)
      • browser.exe (PID: 9108)
      • browser.exe (PID: 8892)

    • Steals credentials from Web Browsers

      • browser.exe (PID: 7560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ChromeSetup.exe (PID: 6876)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 1636)
      • 140.0.7339.81_chrome_installer_uncompressed.exe (PID: 4124)
      • setup.exe (PID: 2728)
      • yb8265.tmp (PID: 7412)
      • setup.exe (PID: 2064)
      • service_update.exe (PID: 6348)
      • Yandex.exe (PID: 2992)
      • updater.exe (PID: 8136)
      • browser.exe (PID: 9020)
      • browser.exe (PID: 8892)

    • Application launched itself

      • updater.exe (PID: 3636)
      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • setup.exe (PID: 2728)
      • setup.exe (PID: 5684)
      • setup.exe (PID: 4644)
      • setup.exe (PID: 2064)
      • updater.exe (PID: 7568)
      • updater.exe (PID: 7644)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 8008)
      • updater.exe (PID: 8100)
      • updater.exe (PID: 8136)
      • service_update.exe (PID: 4664)
      • service_update.exe (PID: 7592)
      • explorer.exe (PID: 7464)
      • updater.exe (PID: 7552)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 8208)

    • Executes as Windows Service

      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 8100)
      • updater.exe (PID: 8136)
      • service_update.exe (PID: 4664)

    • Reads security settings of Internet Explorer

      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • setup.exe (PID: 4644)
      • setup.exe (PID: 2064)
      • service_update.exe (PID: 6348)
      • explorer.exe (PID: 7464)
      • Yandex.exe (PID: 2992)
      • explorer.exe (PID: 5900)
      • browser.exe (PID: 7560)

    • Detected use of alternative data streams (AltDS)

      • setup.exe (PID: 5684)

    • Searches for installed software

      • setup.exe (PID: 2728)
      • setup.exe (PID: 2064)

    • Adds/modifies Windows certificates

      • Yandex.exe (PID: 7140)

    • Starts application with an unusual extension

      • Yandex.exe (PID: 7140)

    • Creates a software uninstall entry

      • setup.exe (PID: 2728)
      • setup.exe (PID: 2064)
      • Yandex.exe (PID: 2992)

    • Reads the date of Windows installation

      • setup.exe (PID: 4644)
      • service_update.exe (PID: 6348)
      • explorer.exe (PID: 7464)

    • Starts itself from another location

      • service_update.exe (PID: 6348)
      • setup.exe (PID: 2064)
      • Yandex.exe (PID: 2992)

    • The process creates files with name similar to system file names

      • setup.exe (PID: 2064)
      • Yandex.exe (PID: 2992)

    • Reads Mozilla Firefox installation path

      • browser.exe (PID: 7560)

    • The process checks if it is being run in the virtual environment

      • browser.exe (PID: 7560)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 8208)

  • INFO

    • The sample compiled with russian language support

      • ChromeSetup.exe (PID: 6876)
      • setup.exe (PID: 2064)

    • Checks supported languages

      • ChromeSetup.exe (PID: 6876)
      • ChromeSetup.exe (PID: 1632)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 3160)
      • updater.exe (PID: 6268)
      • updater.exe (PID: 7048)
      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • 140.0.7339.81_chrome_installer_uncompressed.exe (PID: 4124)
      • setup.exe (PID: 2728)
      • setup.exe (PID: 4580)
      • setup.exe (PID: 5684)
      • setup.exe (PID: 5576)
      • Yandex.exe (PID: 7140)
      • elevation_service.exe (PID: 4540)
      • yb8265.tmp (PID: 7412)
      • setup.exe (PID: 4644)
      • setup.exe (PID: 2064)
      • setup.exe (PID: 7548)
      • updater.exe (PID: 8008)
      • updater.exe (PID: 7824)
      • updater.exe (PID: 7568)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 7776)
      • updater.exe (PID: 7644)
      • updater.exe (PID: 7672)
      • updater.exe (PID: 8136)
      • updater.exe (PID: 7940)
      • updater.exe (PID: 8100)
      • updater.exe (PID: 8084)
      • updater.exe (PID: 6004)
      • service_update.exe (PID: 6348)
      • service_update.exe (PID: 1588)
      • service_update.exe (PID: 4664)
      • service_update.exe (PID: 7592)
      • service_update.exe (PID: 7652)
      • explorer.exe (PID: 7464)
      • service_update.exe (PID: 6524)
      • explorer.exe (PID: 7804)
      • Yandex.exe (PID: 2992)
      • explorer.exe (PID: 5900)
      • UpdaterSetup.exe (PID: 7744)
      • updater.exe (PID: 7780)
      • clidmgr.exe (PID: 7768)
      • updater.exe (PID: 7552)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 7404)
      • browser.exe (PID: 7552)
      • clidmgr.exe (PID: 7832)
      • browser.exe (PID: 7368)
      • browser.exe (PID: 7536)
      • browser.exe (PID: 7492)
      • browser.exe (PID: 5284)
      • browser.exe (PID: 4744)
      • browser.exe (PID: 6356)
      • browser.exe (PID: 5652)
      • browser.exe (PID: 7940)
      • browser.exe (PID: 8072)
      • browser.exe (PID: 2592)
      • browser.exe (PID: 6412)
      • browser.exe (PID: 4520)
      • browser.exe (PID: 864)
      • browser.exe (PID: 8212)
      • browser.exe (PID: 8272)
      • browser.exe (PID: 8512)
      • browser.exe (PID: 7180)
      • browser.exe (PID: 8544)
      • browser.exe (PID: 8568)
      • browser.exe (PID: 8588)
      • browser.exe (PID: 8604)
      • browser.exe (PID: 8596)
      • browser.exe (PID: 8620)
      • browser.exe (PID: 8532)
      • browser.exe (PID: 8520)
      • browser.exe (PID: 8504)
      • browser.exe (PID: 9020)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 9124)
      • browser.exe (PID: 8612)
      • browser.exe (PID: 8576)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 984)
      • browser.exe (PID: 8760)
      • browser.exe (PID: 8700)
      • browser.exe (PID: 8696)
      • browser.exe (PID: 8944)
      • browser.exe (PID: 8964)
      • browser.exe (PID: 8872)
      • browser.exe (PID: 8208)
      • browser.exe (PID: 8000)
      • browser.exe (PID: 8552)
      • browser.exe (PID: 8776)
      • browser.exe (PID: 4084)
      • browser.exe (PID: 8940)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 5456)
      • browser.exe (PID: 8908)
      • browser.exe (PID: 8620)
      • browser.exe (PID: 3620)
      • browser.exe (PID: 8488)
      • browser.exe (PID: 4104)
      • browser.exe (PID: 8556)
      • browser.exe (PID: 7324)
      • browser.exe (PID: 9108)
      • browser.exe (PID: 8892)

    • Create files in a temporary directory

      • ChromeSetup.exe (PID: 6876)
      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • yb8265.tmp (PID: 7412)
      • setup.exe (PID: 4644)
      • setup.exe (PID: 2064)
      • Yandex.exe (PID: 2992)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 6412)
      • service_update.exe (PID: 4664)
      • browser.exe (PID: 9104)

    • The sample compiled with english language support

      • ChromeSetup.exe (PID: 6876)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 1636)
      • 140.0.7339.81_chrome_installer_uncompressed.exe (PID: 4124)
      • setup.exe (PID: 2728)
      • yb8265.tmp (PID: 7412)
      • setup.exe (PID: 2064)
      • service_update.exe (PID: 6348)
      • updater.exe (PID: 8136)
      • browser.exe (PID: 9020)

    • Creates files in the program directory

      • ChromeSetup.exe (PID: 6876)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 3160)
      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • setup.exe (PID: 2728)
      • setup.exe (PID: 5684)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 8136)
      • service_update.exe (PID: 6348)
      • service_update.exe (PID: 7652)
      • updater.exe (PID: 7780)
      • updater.exe (PID: 7552)

    • Reads the computer name

      • ChromeSetup.exe (PID: 1632)
      • updater.exe (PID: 3636)
      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • 140.0.7339.81_chrome_installer_uncompressed.exe (PID: 4124)
      • setup.exe (PID: 2728)
      • setup.exe (PID: 5684)
      • Yandex.exe (PID: 7140)
      • elevation_service.exe (PID: 4540)
      • yb8265.tmp (PID: 7412)
      • setup.exe (PID: 4644)
      • setup.exe (PID: 2064)
      • updater.exe (PID: 7568)
      • updater.exe (PID: 8008)
      • updater.exe (PID: 7644)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 8100)
      • updater.exe (PID: 8136)
      • service_update.exe (PID: 6348)
      • service_update.exe (PID: 1588)
      • service_update.exe (PID: 4664)
      • service_update.exe (PID: 7592)
      • service_update.exe (PID: 7652)
      • Yandex.exe (PID: 2992)
      • explorer.exe (PID: 7464)
      • explorer.exe (PID: 5900)
      • updater.exe (PID: 7552)
      • clidmgr.exe (PID: 7768)
      • clidmgr.exe (PID: 7832)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 7552)
      • browser.exe (PID: 4744)
      • browser.exe (PID: 7404)
      • browser.exe (PID: 6412)
      • browser.exe (PID: 5284)
      • browser.exe (PID: 8212)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 8700)
      • browser.exe (PID: 8944)
      • browser.exe (PID: 8872)
      • browser.exe (PID: 8208)
      • browser.exe (PID: 8760)
      • browser.exe (PID: 8776)
      • browser.exe (PID: 8552)
      • browser.exe (PID: 8000)
      • browser.exe (PID: 8908)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 3636)
      • updater.exe (PID: 1636)
      • updater.exe (PID: 2596)
      • updater.exe (PID: 7568)
      • updater.exe (PID: 7644)
      • updater.exe (PID: 7456)
      • updater.exe (PID: 8008)
      • updater.exe (PID: 8100)
      • updater.exe (PID: 8136)
      • updater.exe (PID: 7552)

    • Checks proxy server information

      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • setup.exe (PID: 2064)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • slui.exe (PID: 7200)
      • browser.exe (PID: 8208)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • setup.exe (PID: 2064)
      • explorer.exe (PID: 7464)
      • browser.exe (PID: 7560)
      • service_update.exe (PID: 4664)
      • browser.exe (PID: 8908)

    • Reads the software policy settings

      • updater.exe (PID: 2596)
      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • setup.exe (PID: 2064)
      • explorer.exe (PID: 7464)
      • updater.exe (PID: 8136)
      • browser.exe (PID: 7560)
      • service_update.exe (PID: 4664)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • slui.exe (PID: 7200)
      • browser.exe (PID: 8208)

    • Creates files or folders in the user directory

      • updater.exe (PID: 3636)
      • Yandex.exe (PID: 7140)
      • setup.exe (PID: 2064)
      • setup.exe (PID: 7548)
      • explorer.exe (PID: 7464)
      • Yandex.exe (PID: 2992)
      • explorer.exe (PID: 5900)
      • clidmgr.exe (PID: 7768)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 7404)
      • browser.exe (PID: 9124)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 984)
      • browser.exe (PID: 8208)
      • browser.exe (PID: 8000)
      • browser.exe (PID: 8908)

    • Launching a file from a Registry key

      • setup.exe (PID: 2728)
      • browser.exe (PID: 7560)

    • Manual execution by a user

      • chrome.exe (PID: 5468)
      • browser.exe (PID: 7560)

    • Yandex updater related mutex has been found

      • Yandex.exe (PID: 7140)
      • service_update.exe (PID: 6348)
      • service_update.exe (PID: 1588)
      • service_update.exe (PID: 7592)
      • service_update.exe (PID: 7652)
      • service_update.exe (PID: 4664)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 6412)
      • browser.exe (PID: 9104)
      • browser.exe (PID: 8316)
      • browser.exe (PID: 8208)

    • Executes as Windows Service

      • elevation_service.exe (PID: 4540)

    • Connects to unusual port

      • chrome.exe (PID: 6160)

    • Application launched itself

      • chrome.exe (PID: 5468)

    • Process checks computer location settings

      • setup.exe (PID: 4644)
      • service_update.exe (PID: 6348)
      • explorer.exe (PID: 7464)
      • Yandex.exe (PID: 2992)
      • explorer.exe (PID: 5900)
      • browser.exe (PID: 7560)
      • browser.exe (PID: 6356)
      • browser.exe (PID: 8072)
      • browser.exe (PID: 2592)
      • browser.exe (PID: 4520)
      • browser.exe (PID: 7180)
      • browser.exe (PID: 864)
      • browser.exe (PID: 8696)

    • Reads CPU info

      • browser.exe (PID: 7560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:08 23:05:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 412160
UninitializedDataSize: 16384
EntryPoint: 0x369f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 135.0.7023.0
ProductVersionNumber: 135.0.7023.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Windows, Cyrillic
Comments: -
CompanyName: Google LLC
FileDescription: Google Installer
FileVersion: 135.0.7023.0
LegalCopyright: Copyright 2024 Google LLC. All rights reserved.
ProductName: Google Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
294
Monitored processes
148
Malicious processes
75
Suspicious processes
6

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
524%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
608%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
856"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5528,i,18151072009137898563,8455630255297238857,2097152 --field-trial-handle=2028,i,7527837606905359762,11522981988883087240,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
140.0.7339.81
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\140.0.7339.81\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
864"C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=B0E1F02C-87AB-4CAF-BE1B-011E6162E1A5 --brand-id=yandex --partner-id=791872 --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=2316,i,1851961383359581962,7495166164627871527,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
browser.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
LOW
Description:
Yandex with voice assistant Alice
Exit code:
0
Version:
25.8.1.834
Modules
Images
c:\users\admin\appdata\local\yandex\yandexbrowser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\yandex\yandexbrowser\application\25.8.1.834\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
984C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1757174292 --annotation=last_update_date=1757174292 --annotation=launches_after_update=2 --annotation=machine_id=97b7721c4994e2556ff6a439510f665d --annotation=main_process_pid=8316 --annotation=metrics_client_id=09b735c9f46a417982a6b2451a00f756 --annotation=plat=Win64 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=25.8.1.834 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7ffc41641bb0,0x7ffc41641bbc,0x7ffc41641bc8C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe
browser.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
MEDIUM
Description:
Yandex with voice assistant Alice
Exit code:
0
Version:
25.8.1.834
Modules
Images
c:\users\admin\appdata\local\yandex\yandexbrowser\application\browser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\yandex\yandexbrowser\application\25.8.1.834\browser_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
1588"C:\Program Files (x86)\Yandex\YandexBrowser\25.8.1.834\service_update.exe" --installC:\Program Files (x86)\Yandex\YandexBrowser\25.8.1.834\service_update.exe
service_update.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
HIGH
Description:
Yandex
Exit code:
0
Version:
25.8.1.834
Modules
Images
c:\program files (x86)\yandex\yandexbrowser\25.8.1.834\service_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1632C:\Users\admin\AppData\Local\Temp\ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\ChromeSetup.exe—ChromeSetup.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Installer
Exit code:
0
Version:
135.0.7023.0
Modules
Images
c:\users\admin\appdata\local\temp\chromesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1636"C:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\updater.exe" --system --windows-service --service=update-internalC:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\updater.exe
services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
135.0.7023.0
Modules
Images
c:\program files (x86)\google\googleupdater\135.0.7023.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1740"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1832,i,6383272382282716332,1924853403775116701,262144 --field-trial-handle=2028,i,7527837606905359762,11522981988883087240,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
140.0.7339.81
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2064"C:\Users\admin\AppData\Local\Temp\YB_5AB81.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\YB_5AB81.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\admin\AppData\Local\Temp\c7038a98-d618-4016-9af7-303c1216b470.tmp" --brand-name=yandex --brand-package="C:\Users\admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\admin\AppData\Local\Temp\clids.xml" --install-start-time-no-uac=1671765025 --installer-brand-id=yandex --installer-partner-id=791872 --installerdata="C:\Users\admin\AppData\Local\Temp\master_preferences" --partner-package="C:\Users\admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --send-statistics --silent --source=lite --variations-update-path="C:\Users\admin\AppData\Local\Temp\3e97e02c-a950-4ecf-b682-a7d970ec8c2d.tmp" --verbose-logging --yandex-website-icon-file="C:\Users\admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=1686795926C:\Users\admin\AppData\Local\Temp\YB_5AB81.tmp\setup.exe
setup.exe
User:
admin
Company:
YANDEX LLC
Integrity Level:
HIGH
Description:
Yandex
Exit code:
1
Version:
25.8.1.834
Modules
Images
c:\users\admin\appdata\local\temp\yb_5ab81.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
47 465
Read events
46 617
Write events
735
Delete events
113

Modification events

(PID) Process:(3636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
Operation:writeName:pv
Value:
135.0.7023.0
(PID) Process:(3636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
Operation:writeName:name
Value:
GoogleUpdater
(PID) Process:(3636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
Operation:writeName:pv
Value:
135.0.7023.0
(PID) Process:(3636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
Operation:writeName:name
Value:
GoogleUpdater
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}
Operation:delete keyName:(default)
Value:
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
Operation:delete keyName:(default)
Value:
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}
Operation:delete keyName:(default)
Value:
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}
Operation:delete keyName:(default)
Value:
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}
Operation:delete keyName:(default)
Value:
(PID) Process:(1636) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}
Operation:writeName:AppID
Value:
{8018F647-BF07-55BB-82BE-A2D7049F7CE4}
Executable files
50
Suspicious files
830
Text files
228
Unknown types
0

Dropped files

PID
Process
Filename
Type
1632ChromeSetup.exeC:\Windows\SystemTemp\Google1632_373613327\UPDATER.PACKED.7Z —
MD5:—
SHA256:—
3636updater.exeC:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\updater.exeexecutable
MD5:962CC41D4BA39FFCFE4E5B513A8179B2
SHA256:E3EB70A25DA3CF0563EBAA3B95622CAD7423E447273BC7C779C7466F39EAC7A2
1636updater.exeC:\Windows\SystemTemp\Google1636_1456229521\scoped_dir1636_1006068785\GoogleUpdate.exeexecutable
MD5:FC6BEC2FD20110CF75394784819949D6
SHA256:323C097DEFB278F09A20AACA7B05AEA20A1C859414CCA9CAEA263FA5A627A1AE
6876ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\ChromeSetup.exeexecutable
MD5:D066A6B7528901BE0D9430502CA24504
SHA256:74EB663434593E3C28ED0805350C3C5636C57FCD8E46201384311FBF3698FA55
6876ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\Yandex.exeexecutable
MD5:AF76E68D9913CE6D0E9F8FF5CCE8571B
SHA256:F278B823D3FD57B682DBA7BB05E925071A184DDD012059E1FE55C6AAF7ECF8DE
6876ChromeSetup.exeC:\Program Files\Google\Chrome\Application\initial_preferencesbinary
MD5:610A16C57633B37DFE70AF47A7BAB564
SHA256:828F7A1615EA930409839EDE784F0B85447F814499A8CEB7EB461734748DAA88
6876ChromeSetup.exeC:\Program Files\Google\Chrome\Application\master_preferencestext
MD5:2F6351B8161CBF183127E0C0E93943A0
SHA256:8603E60A616D8FBAE45C702200D2006679A5C1E2F76BEBCF0418EE4AB5569BBD
3636updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:D9E60D063228E4933E841BCE7D638266
SHA256:5CD86919BF2F1D267612083E6DF837ED8D5918076F23FE55A89D0D5782735B4B
3636updater.exeC:\Program Files (x86)\Google\GoogleUpdater\135.0.7023.0\uninstall.cmdtext
MD5:FBC297EE9060D4256192E4EDB98CAD1B
SHA256:099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
3636updater.exeC:\Program Files (x86)\Google\GoogleUpdater\d132b187-46d6-4b94-b4fb-98202fe8421f.tmpbinary
MD5:BD7FC8AF4A29E2A8EF655C9626953D9A
SHA256:0A9BCE26017779C97A6A6656164D0438F5B7B8AF47EF941044763786C2852B3F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
184
DNS requests
173
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3636
updater.exe
GET
200
142.250.186.163:80
http://c.pki.goog/r/r4.crl
US
binary
530 b
whitelisted
3636
updater.exe
GET
200
142.250.186.163:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
3636
updater.exe
GET
200
142.250.186.163:80
http://o.pki.goog/we2/MFAwTjBMMEowSDAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCDwtar93%2BdmMQSOASEmXU%2Bw%3D%3D
US
binary
277 b
whitelisted
6504
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
NL
binary
407 b
whitelisted
2596
updater.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome/dwmg5mpiqkt6o4ibuphhy2fkrm_140.0.7339.81/-8a69d345-d564-463c-aff1-a69d9e530f96-_140.0.7339.81_all_ac5cw36eiyzaoin7aks5ugjswj7a.crx3
US
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
4224
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6504
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
NL
binary
419 b
whitelisted
7140
Yandex.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
binary
1.41 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5468
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2596
updater.exe
142.250.185.131:443
update.googleapis.com
GOOGLE
US
whitelisted
3636
updater.exe
142.250.186.142:443
dl.google.com
GOOGLE
US
whitelisted
3636
updater.exe
142.250.186.163:80
c.pki.goog
GOOGLE
US
whitelisted
2596
updater.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted
1268
svchost.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 172.217.16.142
whitelisted
update.googleapis.com
  • 142.250.185.131
whitelisted
dl.google.com
  • 142.250.186.142
whitelisted
c.pki.goog
  • 142.250.186.163
unknown
o.pki.goog
  • 142.250.186.163
unknown
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.114
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.128
  • 20.190.159.68
  • 40.126.31.2
  • 40.126.31.129
  • 40.126.31.0
  • 20.190.159.129
  • 20.190.159.64
  • 40.126.31.1
  • 40.126.31.69
  • 20.190.159.75
  • 20.190.159.0
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
7404
browser.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
Process
Message
clidmgr.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 1
clidmgr.exe
GetSidFromEnumSess(): i = 0 : szUserName = Administrator, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
clidmgr.exe
GetSidFromEnumSess(): i = 1 : szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
clidmgr.exe
GetSidFromEnumSess(): ProfileImagePath(2) = C:\Users\admin
clidmgr.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1693682860-607145093-2874071422-1001
clidmgr.exe
GetLoggedCreds_WTSSessionInfo(): szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 1
clidmgr.exe
GetSidFromEnumSess(): i = 0 : szUserName = Administrator, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
clidmgr.exe
GetSidFromEnumSess(): i = 1 : szUserName = admin, szDomain = DESKTOP-JGLLJLD, dwSessionId = 0
clidmgr.exe
GetSidFromEnumSess(): ProfileImagePath(2) = C:\Users\admin
clidmgr.exe
GetSidFromEnumSess(): LsaEnumerateLogonSessions() lpszSid = S-1-5-21-1693682860-607145093-2874071422-1001
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ChromeSetup.exe