Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googlesystem\googleupdater\googleupdatertasksystem143.0.7482.0{6306dbf0-6bef-46dc-80cb-7ee6c09fc805}
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService143.0.7482.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterInternalService143.0.7482.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service -...
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService143.0.7482.0] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\GoogleUpdaterService143.0.7482.0] 'ImagePath' = '"%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\updater.exe" --system --windows-service --service...
Creates the following services
- 'GoogleUpdaterInternalService143.0.7482.0' %ProgramFiles(x86)%\Google\GoogleUpdaterc.0.7482.0�pdater.exe" --system --windows-service --service=update-interna
- 'GoogleUpdaterService143.0.7482.0' %ProgramFiles(x86)%\Google\GoogleUpdaterc.0.7482.0�pdater.exe" --system --windows-service --service=updat
Modifies file system
Creates the following files
- %TEMP%\tmp_3058485093\target.exe
- %TEMP%\tmp_3058485093\agent.exe
- nul
- %ProgramFiles(x86)%\google\googleupdater\updater.log
- %TEMP%\google548_1615669193\updater.packed.7z
- %TEMP%\google548_1401690712\updater.7z
- %TEMP%\google548_1401690712\bin\uninstall.cmd
- %TEMP%\google548_1401690712\bin\updater.exe
- %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\crashpad\settings.dat
- %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\uninstall.cmd
- %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe
- %ProgramFiles(x86)%\google\googleupdater\75724491-bbc9-4d2a-b3c7-098ce612e19c.tmp
- %ProgramFiles(x86)%\google\update\googleupdate.exe
- %ProgramFiles(x86)%\google\googleupdater\ed32af6d-2a3a-423b-93bf-03b29e934d9f.tmp
- %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\51f1c345-3dc6-4dc2-bdea-d561f2b11f74.tmp
- %ProgramFiles(x86)%\chrome_url_fetcher_1968_1710485686\c7ab18cddd6327a6c5930ed03c2598c5106887a8ac35ff1d9c7b33726d09d83b
- %ProgramFiles(x86)%\google\googleupdater\2d9c9891-25b3-4069-9403-c4c315c97011.tmp
- %ProgramFiles(x86)%\google\googleupdater\crx_cache\322dab76-0f57-4bef-aae7-7661a4b8d5ca.tmp
- %ProgramFiles(x86)%\chrome_url_fetcher_1968_1710485686\decoded_xz
- %ProgramFiles(x86)%\google\googleupdater\crx_cache\673b2d98-a0fe-472c-b87c-1c757d3bce67.tmp
- %ProgramFiles(x86)%\chrome_unpacker_beginunzipping1968_1845684414\142.0.7444.60_chrome_installer_uncompressed.exe
Deletes following files that it created itself
- %TEMP%\google548_1401690712\updater.7z
- %TEMP%\google548_1401690712\bin\uninstall.cmd
- %TEMP%\google548_1401690712\bin\updater.exe
- %ProgramFiles(x86)%\chrome_url_fetcher_1968_1710485686\c7ab18cddd6327a6c5930ed03c2598c5106887a8ac35ff1d9c7b33726d09d83b
Moves the following files
- from %ProgramFiles(x86)%\google\googleupdater\75724491-bbc9-4d2a-b3c7-098ce612e19c.tmp to %ProgramFiles(x86)%\google\googleupdater\prefs.json
- from %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\51f1c345-3dc6-4dc2-bdea-d561f2b11f74.tmp to %ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\prefs.json
- from %ProgramFiles(x86)%\google\googleupdater\crx_cache\322dab76-0f57-4bef-aae7-7661a4b8d5ca.tmp to %ProgramFiles(x86)%\google\googleupdater\crx_cache\metadata.json
- from %ProgramFiles(x86)%\chrome_url_fetcher_1968_1710485686\decoded_xz to %ProgramFiles(x86)%\google\googleupdater\crx_cache\13d2d00e7c31db83dd552c8f8b3e4fbaccb2ea711a41057d8dde4bc691a53b46
Network activity
Connects to
- '<LOCALNET>.1.40':8000
- 'up####.googleapis.com':443
- 'ed####.me.gvt1.com':80
- 'dl.google.com':443
TCP
HTTP GET requests
- http://ed####.me.gvt1.com/edgedl/diffgen-puffin/%7B8a69d345-d564-463c-aff1-a69d9e530f96%7D/c7ab18cddd6327a6c5930ed03c2598c5106887a8ac35ff1d9c7b33726d09d83b
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6a##############
Other
- 'up####.googleapis.com':443
- 'dl.google.com':443
UDP
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK up####.googleapis.com
- DNS ASK ed####.me.gvt1.com
- DNS ASK dl.google.com
- DNS ASK mo#####.map.fastly.net
Miscellaneous
Creates and executes the following
- '%TEMP%\tmp_3058485093\target.exe'
- '%TEMP%\tmp_3058485093\agent.exe' -server 19#.#68.1.40:8000
- '%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --system --windows-service --service=update-internal
- '%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --crash-handler --system "--database=%ProgramFiles(x86)%\Google\GoogleUpdater\143.0.7482.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=143.0...
- '%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --system --windows-service --service=update
- '%ProgramFiles(x86)%\google\googleupdater\143.0.7482.0\updater.exe' --unzip-worker --system --mojo-platform-channel-handle=1920
- '%ProgramFiles(x86)%\chrome_unpacker_beginunzipping1968_1845684414\142.0.7444.60_chrome_installer_uncompressed.exe' --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="%ProgramFiles(x86)%\chrome_Unpacker_BeginUnzipping1968_1845684414\c1349bc4-e316-4c4e-8e84-5dd8271361f3.tmp"
Executes the following
- '%ProgramFiles(x86)%\chrome_unpacker_beginunzipping1968_1845684414\142.0.7444.60_chrome_installer_uncompressed.exe' --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="%ProgramFiles(x86)%\chrome_Unpacker_BeginUnzipping1968_1845684414\c1349bc4-e316-4c4e-8e84-5dd8271361f3.tmp"' (with hidden window)
