» chrome.exe
Overview
Analysis
File Details
Behaviors (5)
Programs (5)
Downloads (2)

chrome.exe

Google Chrome

Google Inc

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘GoogleChromeAutoLaunch_1B0E81B795B08FCFC87354BB5741BA8D’. This is installed with Google Chrome. The file has been seen being downloaded from mega.co.nz and multiple other hosts.

File name:

chrome.exe

Publisher:

Google Inc. (signed by Google Inc)

Product:

Google Chrome

Version:

27.0.1453.116

MD5:

5521928aa79079565b7cb8fce6806131

SHA-1:

3825ac809c5a3f1160c0067e1e5e3535c8fe61c1

SHA-256:

66fa68645b6fd4ed583102dfac2478a9d0d32ab35e987e4982e912ea0e96f81b

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

4/23/2024 3:18:28 PM UTC (today)

File size:

806.5 KB (825,808 bytes)

Product version:

27.0.1453.116

Original file name:

chrome.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\google\chrome\application\chrome.exe

Digital Signature

Signed by:

Google Inc

Authority:

VeriSign

Valid from:

11/13/2011 7:00:00 PM

Valid to:

11/13/2014 6:59:59 PM

Subject:

CN=Google Inc, OU=Digital ID Class 3 - Java Object Signing, O=Google Inc, L=Mountain View, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

09E28B26DB593EC4E73286B66499C370

File PE Metadata

Compilation timestamp:

6/14/2013 6:47:41 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:NzbmLWi9HquxRXsP2EdCX+HBR+W4+5OwviydaReaMdA305T4MhM5Y3VFvhrfKxFk:xEGPB35OwviydacRfhJVfKP/M

Entry address:

0x466D0

Entry point:

E8, 42, 92, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, 35, 54, 32, 46, 00, 57, FF, 35, D4, 0F, 49, 00, FF, D6, FF, 35, D0, 0F, 49, 00, 8B, D8, 89, 5D, FC, FF, D6, 8B, F0, 3B, F3, 0F, 82, 81, 00, 00, 00, 8B, FE, 2B, FB, 8D, 47, 04, 83, F8, 04, 72, 75, 53, E8, 98, 92, 00, 00, 8B, D8, 8D, 47, 04, 59, 3B, D8, 73, 48, B8, 00, 08, 00, 00, 3B, D8, 73, 02, 8B, C3, 03, C3, 3B, C3, 72, 0F, 50, FF, 75, FC, E8, D0, 47, 00, 00, 59, 59, 85, C0, 75, 16, 8D, 43, 10, 3B, C3, 72, 3E, 50, FF, 75, FC, E8... 
[+]

Entropy:

6.3797

Packer / compiler:

StarForce V3.X

Code size:

388.5 KB (397,824 bytes)

Scheduled Task

Task name:

{136998D2-9C4A-4796-B9DC-A2E914A9721D}

Trigger:

Registration (Runs on registration)

3 Shell Open Commands

Open type:

ftp

Command:

"C:\users\{user}\appdata\local\google\chrome\application\chrome.exe" -- "%1"

Open type:

http

Command:

"C:\Program Files\google\chrome\application\chrome.exe" -- "%1"

Open type:

https

Command:

"C:\Program Files\google\chrome\application\chrome.exe" -- "%1"

Startup File (User Run)

Registry location:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

GoogleChromeAutoLaunch

Command:

"C:\Program Files\google\chrome\application\chrome.exe" --no-startup-window

The file chrome.exe has been discovered within the following programs.

Frame do Google Chrome by Google Inc

Publisher's description - “Google Chrome Frame is an open source plug-in that seamlessly brings Google Chrome's open web technologies and speedy JavaScript engine to Internet Explorer. Google Chrome Frame is a free plug-in for Internet Explorer.”

developers.google.com/chrome/chrome-frame

7% remove it

Google Chrome by Google Inc

Google Chrome is a free web browser developed by Google that uses the WebKit layout engine. It is designed to be secure, fast, simple and stable. Chrome supports plug-ins with the Netscape Plugin Application Programming Interface (NPAPI).

www.google.com/chrome

6% remove it

Google Chrome App Launcher by Google Inc

Publisher's description - “The Chrome App Launcher is the hub of all your Chrome apps and with it you have quick access to all of your apps from the desktop. When you install an app from the Chrome Web Store, you'll get an option to get the App Launcher.”

www.google.com

12% remove it

Google Chrome Frame by Google Inc

Publisher's description - “Google Chrome Frame is a free plug-in for Internet Explorer. Some advanced web apps use Google Chrome Frame to provide you with additional features and better performance. Sites that utilize Google Chrome Frame become more responsive.”

www.google.com/chromeframe

12% remove it

Google Chrome Frame by Google Inc

www.google.com/chromeframe?

6% remove it

The file chrome.exe has been seen being distributed by the following 2 URLs.

https://mega.co.nz/temporary/.../SBQ1SLQb

file:///C:/Users/Public/.../Google Chrome.lnk

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.