Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\googleupdatetaskmachinecore
- <SYSTEM32>\tasks\googleupdatetaskmachineua
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\gupdate] 'Start' = '00000002'
Modifies file system
Creates the following files
- %WINDIR%\temp\googlechromestandaloneenterprise64.msi
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_fa.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_fi.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_fil.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_fr.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_gu.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_kn.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_et.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_es-419.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_id.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_is.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_it.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_iw.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ja.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_hi.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_hu.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdate.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_hr.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_bg.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatecore.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\googlecrashhandler.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\googlecrashhandler64.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatecomregistershell64.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_am.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_en.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_es.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_en-gb.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ca.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_cs.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_da.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_de.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_el.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ar.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_bn.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdate.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ko.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_mr.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_uk.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ur.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_vi.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_zh-cn.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_zh-tw.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_th.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_tr.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatehelper.msi
- %ProgramFiles(x86)%\google\update\1.3.35.451\psmachine.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\psmachine_64.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatesetup.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatebroker.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\googleupdateondemand.exe
- %ProgramFiles(x86)%\google\update\1.3.35.451\psuser.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\psuser_64.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_lv.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_lt.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_sw.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ms.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_nl.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_no.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_pl.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ta.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ml.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_te.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_pt-br.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_sk.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_sl.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_sr.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_sv.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_pt-pt.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ro.dll
- %ProgramFiles(x86)%\google\update\1.3.35.451\goopdateres_ru.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdatesetup.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\offlinemanifest.gup
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\84.0.4147.89_chrome_installer.exe.{8a69d345-d564-463c-aff1-a69d9e530f96}
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_cs.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_da.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_de.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_el.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_en.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_bn.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_gu.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_bg.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_et.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_fa.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_fi.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_fil.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_fr.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_es.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_en-gb.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_es-419.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_am.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\psmachine.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdate.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googlecrashhandler.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdate.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdatehelper.msi
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdatebroker.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ar.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_hi.dll
- %ProgramFiles(x86)%\google\temp\gut82b7.tmp
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\psmachine_64.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\psuser.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\psuser_64.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googlecrashhandler64.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdatecore.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdatecomregistershell64.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdateondemand.exe
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ca.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_hr.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_sk.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_sr.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_sv.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_sw.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ta.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ru.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_pt-pt.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_sl.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_te.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ur.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_vi.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_zh-cn.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_zh-tw.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_th.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_tr.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_uk.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ro.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_pt-br.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_hu.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_is.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_it.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_iw.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ja.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_kn.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ko.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_id.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_lt.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ml.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_mr.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_ms.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_nl.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_no.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_pl.dll
- %ProgramFiles(x86)%\google\temp\gum82b6.tmp\goopdateres_lv.dll
- %ProgramFiles(x86)%\google\update\offline\{7aa26ea6-da79-446d-ae46-ad69fc832f4a}\offlinemanifest.gup
- %ProgramFiles(x86)%\google\update\offline\{7aa26ea6-da79-446d-ae46-ad69fc832f4a}\{8a69d345-d564-463c-aff1-a69d9e530f96}\84.0.4147.89_chrome_installer.exe
Deletes the following files
- %ProgramFiles(x86)%\google\update\offline\{7aa26ea6-da79-446d-ae46-ad69fc832f4a}\offlinemanifest.gup
- %ProgramFiles(x86)%\google\update\offline\{7aa26ea6-da79-446d-ae46-ad69fc832f4a}\{8a69d345-d564-463c-aff1-a69d9e530f96}\84.0.4147.89_chrome_installer.exe
Network activity
TCP
HTTP GET requests
- http://re####.magicka.co.uk/GoogleChromeStandaloneEnterprise64.exe
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK re####.magicka.co.uk
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\msi74d6.tmp' /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google Chrome&needsAdmin=True"&brand=GCEA&ap=x64-stable"&iid={38395E24-6E43-393B-E28E-2D1082A4AD84}&brand=GCEB&browser=3...
- '%ProgramFiles(x86)%\google\temp\gum82b6.tmp\googleupdate.exe' /silent /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google Chrome&needsAdmin=True"&brand=GCEA&ap=x64-stable"&iid={38395E24-6E43-393B-E28E-2D1082A4AD84}&brand=GCEB&browser=3...
- '%ProgramFiles(x86)%\google\update\1.3.35.451\googleupdatecomregistershell64.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\temp\GoogleChromeStandaloneEnterprise64.msi /quiet
- '<SYSTEM32>\msiexec.exe' /i "%WINDIR%\temp\GoogleChromeStandaloneEnterprise64.msi" /quiet
- '%ProgramFiles(x86)%\google\update\googleupdate.exe' /regsvc
- '%ProgramFiles(x86)%\google\update\googleupdate.exe' /regserver
- '%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NTEiIHNoZWxsX3ZlcnNpb249IjEuMy4yNi45IiBpc21hY2hpbmU...
- '%ProgramFiles(x86)%\google\update\googleupdate.exe' /handoff "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google Chrome&needsAdmin=True&brand=GCEA&ap=x64-stable&iid={38395E24-6E43-393B-E28E-2D1082A4AD84}&brand=GCEB&browser=3&usagestat...
- '%ProgramFiles(x86)%\google\update\googleupdate.exe' /svc
