GoogleUpdate.exe
Google Update by Google Inc (Signed)
Overview
googleupdate.exe has 8 known versions, the most recent one is 1.3.21.103. It is started as a Windows Service called 'gupdate1c9a4adeb791009' with the name 'gupdate' and described as “Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). By adding a startup entry to the run registry key, the file will be executed when the user logs into Windows. In addition the the run registry key, it also creates a scheduled job to be executed by the Windows Task Scheduler up user login, this is typically done in order to bypass a User Account Control (UAC) prompt. The average file size is about 166.6 KB. It is an authenticode code-signed executable issued to Google Inc by the certification authority VeriSign. Numerous variations of googleupdate.exe have been installed with both Google Chrome (VMware ThinApp) and Google Earth. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 18.66 MB. Addionally, typically read and write I/O disk operations is about 38.41 KB per minute for reads and 19.01 KB per minute for writes.
What is googleupdate.exe?
Google products use a process called Google Update to periodically check for updates. This process sends information, such as version number, language, operating system, and other installation or update-related details, back to Google servers. Google Installer is a program which runs in the background of Windows and automatically starts up when your PC boots. It checks for software udpates and automatically downloads and installs them if found.
About googleupdate.exe (from Google Inc)
“To make sure that you're protected by the latest security updates, Google Chrome automatically updates whenever it detects that a new version of the browser is available. The update process happens in”
 Details
|
| File name: | googleupdate.exe |
| Publisher: | Google Inc. |
| Product name: | Google Update |
| Description: | Google Installer |
| Typical file path: | C:\users\user\appdata\local\google\update\googleupdate.exe |
| Certificate |
| Issued to: | Google Inc |
| Authority (CA): | VeriSign |
| Effective date: | Monday, June 18, 2007 |
| Expiration date: | Friday, June 18, 2010 |
| Windows Service |
| Service name: | gupdate |
| Display name: | gupdate1c9a4adeb791009 |
| Description: | “Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.” |
| Type: | Win32OwnProcess |
Programs installed in
(Note, the programs listed below are for all versions of Google Update.)
Google Earth is a virtual globe, map and geographical information program. Google Earth is simply based on 3D maps, with the capability to show 3D buildings and structures (such as bridges), which con...
“Eliminate application conflicts by isolating applications from each other and the underlying OS into a single executable file that can be easily deployed to many endpoints. VMware® ThinApp® accelerate...”
Behaviors
(Note, the behaviors below are for all versions of googleupdate.exe, select a unique version for details.)
Startup files (user) run
Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
- 'Google Update' → "C:\users\user\appdata\Local\Google\Update\GoogleUpdate.exe" /c
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
Scheduled tasks
- The task 'GoogleUpdateTaskUserS-1-5-21-4040762489-3244682431-1063801501-1001UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4040762489-3244682431-1063801501-1001UA'
- The job 'GoogleUpdateTaskUserS-1-5-21-4040762489-3244682431-1063801501-1001Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4040762489-3244682431-1063801501-1001Core'
- The task 'GoogleUpdateTaskUserS-1-5-21-3286019870-1475449969-3554601053-1000UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3286019870-1475449969-3554601053-1000UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-3286019870-1475449969-3554601053-1000Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3286019870-1475449969-3554601053-1000Core'
- The job 'GoogleUpdateTaskUserS-1-5-21-3305648521-2958999256-107983701-1002UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3305648521-2958999256-107983701-1002UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-3305648521-2958999256-107983701-1002Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3305648521-2958999256-107983701-1002Core'
- The job 'GoogleUpdateTaskUserS-1-5-21-3644473725-3640809915-1163733049-1000UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3644473725-3640809915-1163733049-1000UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-3644473725-3640809915-1163733049-1000Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3644473725-3640809915-1163733049-1000Core'
- The task 'GoogleUpdateTaskUserS-1-5-21-780999901-2708500014-2551514655-1000UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-780999901-2708500014-2551514655-1000UA'
- The job 'GoogleUpdateTaskUserS-1-5-21-780999901-2708500014-2551514655-1000Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-780999901-2708500014-2551514655-1000Core'
- The job 'GoogleUpdateTaskMachineUA1cf876f52574e6a' runs daily in the path '\GoogleUpdateTaskMachineUA1cf876f52574e6a'
- The job 'GoogleUpdateTaskUserS-1-5-21-1714702166-3828736240-2364637561-1001UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-1714702166-3828736240-2364637561-1001UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-1714702166-3828736240-2364637561-1001Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-1714702166-3828736240-2364637561-1001Core'
- The job 'GoogleUpdateTaskUserS-1-5-21-4213831199-1925155440-1856091304-1000UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4213831199-1925155440-1856091304-1000UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-4213831199-1925155440-1856091304-1000Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4213831199-1925155440-1856091304-1000Core'
- The job 'GoogleUpdateTaskUserS-1-5-21-1467336047-3671384462-808872918-1001UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-1467336047-3671384462-808872918-1001UA'
- The task 'GoogleUpdateTaskUserS-1-5-21-1467336047-3671384462-808872918-1001Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-1467336047-3671384462-808872918-1001Core'
- The task 'GoogleUpdateTaskUserS-1-5-21-4143023575-1045065631-1360249355-1001UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4143023575-1045065631-1360249355-1001UA'
- The job 'GoogleUpdateTaskUserS-1-5-21-4143023575-1045065631-1360249355-1001Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-4143023575-1045065631-1360249355-1001Core'
- The task 'GoogleUpdateTaskUserS-1-5-21-3518954986-860323-3029074054-1000UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3518954986-860323-3029074054-1000UA'
- The job 'GoogleUpdateTaskUserS-1-5-21-3518954986-860323-3029074054-1000Core' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-3518954986-860323-3029074054-1000Core'
- The job 'GoogleUpdateTaskUserS-1-5-21-872894108-2829445789-3937978749-1001UA' runs daily in the path '\GoogleUpdateTaskUserS-1-5-21-872894108-2829445789-3937978749-1001UA'
Scheduled tasks startups
Set to load on user login (bypasses Windows UAC if enabled)
- Login entry path 'L:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job'
- Login entry path '\GoogleUpdateTaskMachineCore1cecbd45b3a8213'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1ce84615a736d32.job'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cea9d5293c17e2.job'
- Login entry path '\GoogleUpdateTaskMachineCore1ce7aa369f8ada6'
- Login entry path '\GoogleUpdateTaskMachineCore1ca5db9f0198650'
- Login entry path '\GoogleUpdateTaskMachineCore1cce6a17e13e8fd'
- Login entry path '\GoogleUpdateTaskMachineCore1cc92a7b39f6800'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1ce05c553efaab8.job'
- Login entry path '\GoogleUpdateTaskMachineCore1cdc58d2accdb9c'
- Login entry path 'C:\WINXP\Tasks\GoogleUpdateTaskMachineCore1ce054f10035172.job'
- Login entry path '\GoogleUpdateTaskMachineCore1cd9a8a6809015d'
- Login entry path 'C:\WINDOWS.0\Tasks\GoogleUpdateTaskMachineCore.job'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cde6586d81c3c6.job'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cc71024b1a2f00.job'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd60417c1ef31a.job'
- Login entry path 'C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job'
- Login entry path '\GoogleUpdateTaskMachineCore1cd08eb84d00124'
- Login entry path 'D:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job'
- Login entry path '\GoogleUpdateTaskMachineCore1cd6a67648c3f42'
- Login entry path 'D:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd628cca255480.job'
- Login entry path 'C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1cd1a82bee2d0fe.job'
All file variations of googleupdate.exe
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Home Premium |
55.50% |
|
| Windows 7 Ultimate |
14.75% |
|
| Microsoft Windows XP |
10.00% |
|
| Windows 7 Professional |
8.25% |
|
| Windows Vista Home Premium |
4.25% |
|
| Windows 7 Home Basic |
1.75% |
|
| Windows 7 Starter |
1.75% |
|
| Windows Vista Home Basic |
1.25% |
|
| Windows Developer Preview |
1.25% |
|
| Windows 8.1 |
1.25% |
|
Distribution by country
United States installs about 53.40% of Google Update.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
21.94% |
|
| Toshiba |
20.50% |
|
| Hewlett-Packard |
16.19% |
|
| ASUS |
10.43% |
|
| Acer |
8.81% |
|
| Lenovo |
5.76% |
|
| NEC |
3.60% |
|
| Sony |
3.24% |
|
| Samsung |
2.16% |
|
| Sahara |
2.16% |
|
| GIGABYTE |
1.80% |
|
| American Megatrends |
1.44% |
|
| MSI |
1.08% |
|
| Alienware |
0.90% |
|
