File name:

ChromeSetup.exe

Full analysis: https://app.any.run/tasks/37c9398f-61ef-4c11-a0a1-65852db10314
Verdict: Malicious activity
Analysis date: July 04, 2025, 12:22:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

FBFC2F0559AA59CC20E18FA39F9EF478

SHA1:

4B4FACE826E8F70A250EA51361BD14CB7C5A53A1

SHA256:

FB3F5F14A75F67311EA59F8B19AA0BF33435D2448A9DC06F7BB5BF6BAB0519DF

SSDEEP:

98304:ccA8SGZGtjCDKExxCYg5aJLegqNZYCZEspjKwVV8hSPD5IJY+E6CAU7mk21KW6bB:yyGl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • setup.exe (PID: 5012)

  • SUSPICIOUS

    • Application launched itself

      • ChromeSetup.exe (PID: 2324)
      • updater.exe (PID: 7160)
      • updater.exe (PID: 1508)
      • setup.exe (PID: 5012)
      • setup.exe (PID: 6772)
      • updater.exe (PID: 320)

    • Executes as Windows Service

      • updater.exe (PID: 1508)
      • updater.exe (PID: 320)

    • Reads security settings of Internet Explorer

      • ChromeSetup.exe (PID: 2324)
      • updater.exe (PID: 7160)

    • Executable content was dropped or overwritten

      • updater.exe (PID: 7160)
      • 138.0.7204.97_chrome_installer_uncompressed.exe (PID: 5620)
      • setup.exe (PID: 5012)
      • updater.exe (PID: 1508)

    • Searches for installed software

      • setup.exe (PID: 5012)

    • Creates a software uninstall entry

      • setup.exe (PID: 5012)

  • INFO

    • The sample compiled with english language support

      • ChromeSetup.exe (PID: 2324)
      • updater.exe (PID: 1508)
      • updater.exe (PID: 7160)
      • 138.0.7204.97_chrome_installer_uncompressed.exe (PID: 5620)
      • setup.exe (PID: 5012)

    • Process checks computer location settings

      • ChromeSetup.exe (PID: 2324)

    • Checks supported languages

      • updater.exe (PID: 7160)
      • ChromeSetup.exe (PID: 4088)
      • updater.exe (PID: 6700)
      • ChromeSetup.exe (PID: 2324)
      • updater.exe (PID: 2032)
      • updater.exe (PID: 1508)
      • updater.exe (PID: 320)
      • updater.exe (PID: 6428)
      • 138.0.7204.97_chrome_installer_uncompressed.exe (PID: 5620)
      • setup.exe (PID: 5012)
      • setup.exe (PID: 6596)
      • setup.exe (PID: 6772)
      • setup.exe (PID: 3800)
      • elevation_service.exe (PID: 6536)

    • Creates files in the program directory

      • updater.exe (PID: 6700)
      • updater.exe (PID: 7160)
      • updater.exe (PID: 1508)
      • updater.exe (PID: 320)
      • setup.exe (PID: 5012)
      • setup.exe (PID: 6772)

    • Create files in a temporary directory

      • ChromeSetup.exe (PID: 4088)
      • updater.exe (PID: 7160)

    • Reads the computer name

      • updater.exe (PID: 1508)
      • updater.exe (PID: 7160)
      • ChromeSetup.exe (PID: 2324)
      • ChromeSetup.exe (PID: 4088)
      • updater.exe (PID: 320)
      • 138.0.7204.97_chrome_installer_uncompressed.exe (PID: 5620)
      • setup.exe (PID: 5012)
      • setup.exe (PID: 6772)
      • elevation_service.exe (PID: 6536)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 1508)
      • updater.exe (PID: 7160)
      • updater.exe (PID: 320)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 7160)

    • Creates files or folders in the user directory

      • updater.exe (PID: 7160)

    • Manual execution by a user

      • cmd.exe (PID: 3648)
      • Taskmgr.exe (PID: 420)
      • Taskmgr.exe (PID: 2468)
      • chrome.exe (PID: 5436)

    • Reads the software policy settings

      • updater.exe (PID: 7160)
      • updater.exe (PID: 320)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 420)

    • Launching a file from a Registry key

      • setup.exe (PID: 5012)

    • Executes as Windows Service

      • elevation_service.exe (PID: 6536)

    • Application launched itself

      • chrome.exe (PID: 5436)

    • Connects to unusual port

      • chrome.exe (PID: 6684)

    • Checks proxy server information

      • updater.exe (PID: 7160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:22 03:02:31+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 3659264
InitializedDataSize: 7652864
UninitializedDataSize: -
EntryPoint: 0x1d1990
OSVersion: 10
ImageVersion: -
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 138.0.7194.0
ProductVersionNumber: 138.0.7194.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Installer (x86)
FileVersion: 138.0.7194.0
InternalName: Google Installer (x86)
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
OriginalFileName: UpdaterSetup.exe
ProductName: Google Installer (x86)
ProductVersion: 138.0.7194.0
CompanyShortName: Google
ProductShortName: GoogleUpdater
LastChange: 5f61f8e2e5320b2ca29a33ef2235c25f1c198854-refs/branch-heads/7194@{#1}
OfficialBuild: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
36
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chromesetup.exe no specs chromesetup.exe updater.exe updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs cmd.exe conhost.exe no specs msiexec.exe no specs 138.0.7204.97_chrome_installer_uncompressed.exe taskmgr.exe no specs taskmgr.exe setup.exe setup.exe no specs msiexec.exe no specs setup.exe no specs setup.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --system --windows-service --service=updateC:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe
services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x86)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
420"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1952,i,8798564778463054878,8160648283967462132,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
138.0.7204.97
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\138.0.7204.97\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1204"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1952,i,8798564778463054878,8160648283967462132,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
138.0.7204.97
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\138.0.7204.97\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1508"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --system --windows-service --service=update-internalC:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe
services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x86)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2032"C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=138.0.7194.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x14529c0,0x14529cc,0x14529d8C:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater (x86)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\program files (x86)\google\googleupdater\138.0.7194.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2180"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=138.0.7204.97 --initial-client-data=0x228,0x22c,0x230,0x224,0x220,0x7ffc449566e8,0x7ffc449566f4,0x7ffc44956700C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
138.0.7204.97
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2324"C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe" C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Installer (x86)
Exit code:
0
Version:
138.0.7194.0
Modules
Images
c:\users\admin\appdata\local\temp\chromesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2468"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
3000"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1952,i,8798564778463054878,8160648283967462132,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
138.0.7204.97
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\138.0.7204.97\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
7 888
Read events
7 731
Write events
142
Delete events
15

Modification events

(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}
Operation:writeName:AppID
Value:
{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}
Operation:writeName:LocalService
Value:
GoogleUpdaterInternalService138.0.7194.0
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4A8EC270-ECA5-51BC-A8AB-551ED6D0CA26}
Operation:writeName:ServiceParameters
Value:
--com-service
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D12C0CB6-7717-5083-8874-A3C30BB3C374}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D12C0CB6-7717-5083-8874-A3C30BB3C374}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D40B89-9B8C-53BE-9B9E-BEB2AD53DE28}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(7160) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{48D40B89-9B8C-53BE-9B9E-BEB2AD53DE28}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1508) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1508) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(1508) updater.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib
Operation:writeName:Version
Value:
1.0
Executable files
8
Suspicious files
108
Text files
55
Unknown types
23

Dropped files

PID
Process
Filename
Type
4088ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\Google4088_349602950\UPDATER.PACKED.7Z —
MD5:—
SHA256:—
7160updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:04564DCB904BAF2FB7960B9259FFD51D
SHA256:52F8671C1058BAEBA8A9CE5878975C8BC268B414994DAB89DA1D6FF1B1161943
7160updater.exeC:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\updater.exeexecutable
MD5:A1044445F76098186DE3B146ABDA9876
SHA256:8CA4F944172F0904B4D70E40A5D61B54439109502E7E3E20D71F8A83BEAD9CE8
7160updater.exeC:\Program Files (x86)\Google\GoogleUpdater\6ab3333d-15db-40ee-8994-f30b12e7da60.tmpbinary
MD5:4D8DF8FA0D5BE0C431DB342041019C34
SHA256:D9CF12B4F14BD5ABB0B6C967A3DFE3293FEBF1FF251E7ACECBEDB6801CF52E5C
320updater.exeC:\Windows\SystemTemp\chrome_url_fetcher_320_1727920675\f11035a609826e842104c6a00f39912a0d6a8ea396d32d9c6dc7fa62167cab8a —
MD5:—
SHA256:—
1508updater.exeC:\Program Files (x86)\Google\Update\GoogleUpdate.exeexecutable
MD5:A1044445F76098186DE3B146ABDA9876
SHA256:8CA4F944172F0904B4D70E40A5D61B54439109502E7E3E20D71F8A83BEAD9CE8
1508updater.exeC:\Program Files (x86)\Google\GoogleUpdater\prefs.json~RF1755d0.TMPbinary
MD5:4D8DF8FA0D5BE0C431DB342041019C34
SHA256:D9CF12B4F14BD5ABB0B6C967A3DFE3293FEBF1FF251E7ACECBEDB6801CF52E5C
1508updater.exeC:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\prefs.jsonbinary
MD5:AA2D0C0C72BB528CF4168EA91C1C9A56
SHA256:E03E9D262CA3B7D19E37C3A69C7D8B46BD3F5542AA555A17D864071C28257B2C
7160updater.exeC:\Program Files (x86)\Google\GoogleUpdater\138.0.7194.0\uninstall.cmdtext
MD5:FBC297EE9060D4256192E4EDB98CAD1B
SHA256:099592FFA867124D16C0C6D868AF1214FD2B7180FA76E4EEE01ABF2A5CF8F044
1508updater.exeC:\Windows\SystemTemp\Google1508_1427805351\scoped_dir1508_439699423\GoogleUpdate.exeexecutable
MD5:FC6BEC2FD20110CF75394784819949D6
SHA256:323C097DEFB278F09A20AACA7B05AEA20A1C859414CCA9CAEA263FA5A627A1AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
67
DNS requests
68
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7160
updater.exe
GET
200
142.250.181.227:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEAo1gm31egIKCiGPvfORQ8M%3D
unknown
—
—
whitelisted
7160
updater.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
320
updater.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/diffgen-puffin/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D/f11035a609826e842104c6a00f39912a0d6a8ea396d32d9c6dc7fa62167cab8a
unknown
—
—
whitelisted
5444
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7160
updater.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1132
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6768
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
320
updater.exe
142.250.185.131:443
update.googleapis.com
GOOGLE
US
whitelisted
7160
updater.exe
172.217.16.206:443
dl.google.com
GOOGLE
US
whitelisted
7160
updater.exe
172.217.16.195:80
c.pki.goog
GOOGLE
US
whitelisted
7160
updater.exe
142.250.181.227:80
o.pki.goog
GOOGLE
US
whitelisted
320
updater.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
update.googleapis.com
  • 142.250.185.131
whitelisted
dl.google.com
  • 172.217.16.206
whitelisted
c.pki.goog
  • 172.217.16.195
whitelisted
o.pki.goog
  • 142.250.181.227
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
www.bing.com
  • 92.123.104.62
  • 92.123.104.9
  • 92.123.104.5
  • 92.123.104.53
  • 92.123.104.65
  • 92.123.104.61
  • 92.123.104.63
  • 92.123.104.66
  • 92.123.104.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
th.bing.com
  • 92.123.104.33
  • 92.123.104.26
  • 92.123.104.52
  • 92.123.104.34
  • 92.123.104.41
  • 92.123.104.18
  • 92.123.104.47
  • 92.123.104.50
  • 92.123.104.49
whitelisted

Threats

PID
Process
Class
Message
6684
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6684
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
Process
Message
chrome.exe
I0000 00:00:1751631799.383295 2148 voice_transcription.cc:58] Registering VoiceTranscriptionCapability
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ChromeSetup.exe