CmdID

CmdID / Files

chrome_installer.exe

Google Chrome Installer file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real chrome_installer.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\84.0.4147.125\
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\85.0.4183.121\
C:\program files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\85.0.4183.83\
Signed byGoogle LLC
ProductGoogle Chrome Installer, Google LLC
DescriptionGoogle Chrome Installer

4 known copies

95.0.4638.69 · C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\95.0.4638.69\chrome_installer.exe · signed by Google LLC

a9f5ee60dacc839b7d7503dbd1e92675b1593cc0d869e06d77bbec72abad7c71

85.0.4183.121 · C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\85.0.4183.121\chrome_installer.exe · signed by Google LLC

049e3f0601edeb826ee061a9a8c2ec585ef477f7745678eba253b03f9e6d2774

85.0.4183.83 · C:\program files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\85.0.4183.83\chrome_installer.exe · signed by Google LLC

989aa877d7ae85c86b85ceddd51fcab456dbb88ec6eb9687895daeef9a104c52

84.0.4147.125 · C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\84.0.4147.125\chrome_installer.exe · signed by Google LLC

f3a251164e16b69fb4e11ae97af1e5950149f1c994430af43a7a391f04d6938d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name chrome_installer.exe
highPotentially Suspicious GoogleUpdate Child ProcessNasreddine Bencherchali (Nextron Systems)