Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Clients\StartMenuInternet\GPT Chrome\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe"'
- [HKLM\Software\Classes\TSBrowserHTM.pdf\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.doc\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.docx\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.ppt\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.pptx\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.xls\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM.xlsx\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
- [HKLM\Software\Classes\TSBrowserHTM\shell\open\command] '' = '"D:\Program Files\GptChrome\GptBrowser.exe" --single-argument %1'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\GptChromeSrv] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\GptChromeSrv] 'ImagePath' = 'D:\Program Files\GptChrome\GptChromeService.exe'
Creates the following services
- 'GptChromeSrv' D:\Program Files\GptChrome\GptChromeService.exe
Malicious functions
Injects code into
the following user processes:
- gptbrowser.exe
Modifies file system
Creates the following files
- D:\program files\gptchrome\ginstallerpkg.tmp
- %LOCALAPPDATA%\spchrome\user data\default\history-journal
- %LOCALAPPDATA%\spchrome\user data\default\web data-journal
- %LOCALAPPDATA%\spchrome\user data\default\history
- %LOCALAPPDATA%\spchrome\user data\default\web data
- %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\manifest-000001
- %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\000001.dbtmp
- %LOCALAPPDATA%\spchrome\user data\shadercache\data_3
- %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\log
- %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\manifest-000001
- %LOCALAPPDATA%\spchrome\user data\first run
- %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\000001.dbtmp
- %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\000003.log
- %LOCALAPPDATA%\spchrome\user data\default\affiliation database-journal
- %LOCALAPPDATA%\spchrome\user data\default\1602bdaf-b4ad-4ffe-9418-297b021bfa73.tmp
- %LOCALAPPDATA%\spchrome\user data\superchromecache\bookmarks.ini
- %LOCALAPPDATA%\spchrome\user data\default\readme
- %LOCALAPPDATA%\spchrome\user data\last version
- %LOCALAPPDATA%\spchrome\user data\shadercache\data_2
- %LOCALAPPDATA%\spchrome\user data\default\favicons-journal
- D:\program files\gptchrome\109.0.5414.155\vulkan-1.dll
- D:\program files\gptchrome\gptbrowser.exe
- D:\program files\gptchrome\gptbro_proxy.exe
- D:\program files\gptchrome\gptchromeservice.exe
- D:\program files\gptchrome\setup.exe
- D:\program files\gptchrome\spupdate.exe
- %LOCALAPPDATA%\spchrome\user data\default\affiliation database
- D:\program files\gptchrome\109.0.5414.155\solution.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\gpt chrome.lnk
- D:\program files\gptchrome\uninstall.exe
- %LOCALAPPDATA%\spchrome\user data\browsermetrics\browsermetrics-659dee34-f8.pma
- C:\users\public\desktop\gpt chrome.lnk
- %LOCALAPPDATA%\spchrome\user data\4770dae4-7a50-4668-aaf4-5d2658f03c03.tmp
- %LOCALAPPDATA%\spchrome\user data\shadercache\index
- %LOCALAPPDATA%\spchrome\user data\shadercache\data_0
- %LOCALAPPDATA%\spchrome\user data\shadercache\data_1
- %LOCALAPPDATA%\spchrome\user data\constant.json
- %LOCALAPPDATA%\spchrome\user data\crashpad\settings.dat
- %LOCALAPPDATA%\spchrome\user data\variations
- D:\program files\gptchrome\109.0.5414.155\locales\sv.pak
- %LOCALAPPDATA%\spchrome\user data\default\login data-journal
- %LOCALAPPDATA%\spchrome\user data\default\gpucache\data_0
- %LOCALAPPDATA%\spchrome\user data\default\gpucache\data_1
- %LOCALAPPDATA%\spchrome\user data\default\gpucache\data_2
- %LOCALAPPDATA%\spchrome\user data\default\gpucache\data_3
- %LOCALAPPDATA%\spchrome\user data\default\dawncache\index
- %LOCALAPPDATA%\spchrome\user data\default\dawncache\data_0
- %LOCALAPPDATA%\spchrome\user data\default\dawncache\data_1
- %LOCALAPPDATA%\spchrome\user data\default\dawncache\data_2
- %LOCALAPPDATA%\spchrome\user data\default\gpucache\index
- D:\program files\gptchrome\109.0.5414.155\screencut.dll
- %LOCALAPPDATA%\spchrome\user data\default\top sites
- %LOCALAPPDATA%\spchrome\user data\default\cache\cache_data\data_1
- %LOCALAPPDATA%\spchrome\user data\default\cache\cache_data\data_2
- %LOCALAPPDATA%\spchrome\user data\default\cache\cache_data\data_3
- %LOCALAPPDATA%\spchrome\user data\grshadercache\index
- %LOCALAPPDATA%\spchrome\user data\grshadercache\data_0
- %LOCALAPPDATA%\spchrome\user data\grshadercache\data_1
- %LOCALAPPDATA%\spchrome\user data\grshadercache\data_2
- %LOCALAPPDATA%\spchrome\user data\default\cache\cache_data\index
- %LOCALAPPDATA%\spchrome\user data\default\dawncache\data_3
- D:\program files\gptchrome\109.0.5414.155\vk_swiftshader.dll
- %LOCALAPPDATA%\spchrome\user data\browsermetrics\browsermetrics-659dee3e-7c8.pma
- %LOCALAPPDATA%\spchrome\user data\default\d70e56ab-2932-42e0-8fd0-a220a78c9d0b.tmp
- %LOCALAPPDATA%\spchrome\user data\default\code cache\wasm\index
- %LOCALAPPDATA%\spchrome\user data\default\code cache\js\index
- %LOCALAPPDATA%\spchrome\user data\default\extension scripts\log
- %LOCALAPPDATA%\spchrome\user data\default\extension scripts\manifest-000001
- %LOCALAPPDATA%\spchrome\user data\default\login data
- %LOCALAPPDATA%\spchrome\user data\default\extension scripts\000001.dbtmp
- %LOCALAPPDATA%\spchrome\user data\default\code cache\wasm\index-dir\temp-index
- %LOCALAPPDATA%\spchrome\user data\default\top sites-journal
- %LOCALAPPDATA%\spchrome\user data\default\code cache\webui_js\index
- %LOCALAPPDATA%\spchrome\user data\default\favicons
- %LOCALAPPDATA%\spchrome\user data\default\code cache\webui_js\index-dir\temp-index
- %LOCALAPPDATA%\spchrome\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\spchrome\user data\default\login data for account
- %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\log
- %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\manifest-000001
- %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\000001.dbtmp
- %LOCALAPPDATA%\spchrome\user data\default\d9864b41-7574-40a9-8695-efa8d1c6b41e.tmp
- %LOCALAPPDATA%\spchrome\user data\default\login data for account-journal
- %LOCALAPPDATA%\spchrome\user data\default\extension scripts\000003.log
- D:\program files\gptchrome\109.0.5414.155\notification_helper.exe
- D:\program files\gptchrome\109.0.5414.155\mojo_core.dll
- D:\program files\gptchrome\109.0.5414.155\libglesv2.dll
- D:\program files\gptchrome\109.0.5414.155\locales\fa.pak
- D:\program files\gptchrome\109.0.5414.155\locales\fi.pak
- D:\program files\gptchrome\109.0.5414.155\locales\fil.pak
- D:\program files\gptchrome\109.0.5414.155\locales\fr.pak
- D:\program files\gptchrome\109.0.5414.155\locales\gu.pak
- D:\program files\gptchrome\109.0.5414.155\locales\he.pak
- D:\program files\gptchrome\109.0.5414.155\locales\es-419.pak
- D:\program files\gptchrome\109.0.5414.155\locales\af.pak
- D:\program files\gptchrome\109.0.5414.155\locales\et.pak
- D:\program files\gptchrome\109.0.5414.155\locales\hi.pak
- D:\program files\gptchrome\109.0.5414.155\locales\it.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ja.pak
- D:\program files\gptchrome\109.0.5414.155\locales\kn.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ko.pak
- D:\program files\gptchrome\109.0.5414.155\locales\lt.pak
- D:\program files\gptchrome\109.0.5414.155\locales\lv.pak
- D:\program files\gptchrome\109.0.5414.155\locales\hr.pak
- D:\program files\gptchrome\109.0.5414.155\locales\hu.pak
- D:\program files\gptchrome\109.0.5414.155\locales\id.pak
- %LOCALAPPDATA%\spchrome\user data\grshadercache\data_3
- D:\program files\gptchrome\109.0.5414.155\locales\ml.pak
- D:\program files\gptchrome\109.0.5414.155\locales\el.pak
- D:\program files\gptchrome\7za.exe
- D:\program files\gptchrome\109.0.5414.155\109.0.5414.155.manifest
- D:\program files\gptchrome\109.0.5414.155\chrome_100_percent.pak
- D:\program files\gptchrome\109.0.5414.155\chrome_200_percent.pak
- D:\program files\gptchrome\109.0.5414.155\everything.lng
- D:\program files\gptchrome\109.0.5414.155\extensions\external_extensions.json
- D:\program files\gptchrome\109.0.5414.155\icudtl.dat
- D:\program files\gptchrome\109.0.5414.155\locales\en-gb.pak
- D:\program files\gptchrome\109.0.5414.155\locales\en-us.pak
- D:\program files\gptchrome\109.0.5414.155\icudtlex.dat
- D:\program files\gptchrome\109.0.5414.155\locales\ar.pak
- D:\program files\gptchrome\109.0.5414.155\locales\bg.pak
- D:\program files\gptchrome\109.0.5414.155\locales\bn.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ca.pak
- D:\program files\gptchrome\109.0.5414.155\locales\cs.pak
- D:\program files\gptchrome\109.0.5414.155\locales\da.pak
- D:\program files\gptchrome\109.0.5414.155\locales\de.pak
- D:\program files\gptchrome\ginstallerpkg
- D:\program files\gptchrome\109.0.5414.155\locales\am.pak
- %LOCALAPPDATA%\spchrome\user data\default\cache\cache_data\data_0
- D:\program files\gptchrome\109.0.5414.155\locales\mr.pak
- D:\program files\gptchrome\109.0.5414.155\locales\nl.pak
- D:\program files\gptchrome\109.0.5414.155\v8_context_snapshot.bin
- D:\program files\gptchrome\109.0.5414.155\visualelements\excel.ico
- D:\program files\gptchrome\109.0.5414.155\visualelements\logo.png
- D:\program files\gptchrome\109.0.5414.155\visualelements\pdf.ico
- D:\program files\gptchrome\109.0.5414.155\visualelements\ppt.ico
- D:\program files\gptchrome\109.0.5414.155\visualelements\smalllogo.png
- D:\program files\gptchrome\109.0.5414.155\visualelements\word.ico
- D:\program files\gptchrome\109.0.5414.155\locales\ms.pak
- D:\program files\gptchrome\109.0.5414.155\resources.pak
- D:\program files\gptchrome\109.0.5414.155\meipreload\preloaded_data.pb
- D:\program files\gptchrome\109.0.5414.155\chrome_elf.dll
- D:\program files\gptchrome\109.0.5414.155\chrome_pwa_launcher.exe
- D:\program files\gptchrome\109.0.5414.155\chrome_wer.dll
- D:\program files\gptchrome\109.0.5414.155\d3dcompiler_47.dll
- D:\program files\gptchrome\109.0.5414.155\eventlog_provider.dll
- D:\program files\gptchrome\109.0.5414.155\everything.exe
- D:\program files\gptchrome\109.0.5414.155\libegl.dll
- D:\program files\gptchrome\109.0.5414.155\vk_swiftshader_icd.json
- D:\program files\gptchrome\109.0.5414.155\chrome.dll
- D:\program files\gptchrome\109.0.5414.155\locales\nb.pak
- D:\program files\gptchrome\109.0.5414.155\7za.exe
- D:\program files\gptchrome\109.0.5414.155\locales\es.pak
- D:\program files\gptchrome\109.0.5414.155\locales\pl.pak
- D:\program files\gptchrome\109.0.5414.155\locales\pt-br.pak
- D:\program files\gptchrome\109.0.5414.155\locales\pt-pt.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ro.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ru.pak
- D:\program files\gptchrome\109.0.5414.155\locales\sk.pak
- D:\program files\gptchrome\109.0.5414.155\locales\sl.pak
- D:\program files\gptchrome\109.0.5414.155\locales\zh-cn.pak
- D:\program files\gptchrome\109.0.5414.155\meipreload\manifest.json
- D:\program files\gptchrome\109.0.5414.155\locales\zh-tw.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ta.pak
- D:\program files\gptchrome\109.0.5414.155\locales\te.pak
- D:\program files\gptchrome\109.0.5414.155\locales\th.pak
- D:\program files\gptchrome\109.0.5414.155\locales\tr.pak
- D:\program files\gptchrome\109.0.5414.155\locales\uk.pak
- D:\program files\gptchrome\109.0.5414.155\locales\ur.pak
- D:\program files\gptchrome\109.0.5414.155\locales\vi.pak
- D:\program files\gptchrome\109.0.5414.155\locales\sr.pak
- D:\program files\gptchrome\109.0.5414.155\locales\sw.pak
- %LOCALAPPDATA%\spchrome\user data\browsermetrics-spare.pma.tmp
Deletes the following files
- D:\program files\gptchrome\ginstallerpkg
- D:\program files\gptchrome\7za.exe
- %LOCALAPPDATA%\spchrome\user data\default\1602bdaf-b4ad-4ffe-9418-297b021bfa73.tmp
- %LOCALAPPDATA%\spchrome\user data\default\google profile.ico~rfe4d83.tmp
- %LOCALAPPDATA%\spchrome\user data\local state~rfe7399.tmp
- %LOCALAPPDATA%\spchrome\user data\browsermetrics\browsermetrics-659dee34-f8.pma
- %LOCALAPPDATA%\spchrome\user data\browsermetrics\browsermetrics-659dee3e-7c8.pma
Moves the following files
- from D:\program files\gptchrome\ginstallerpkg.tmp to D:\program files\gptchrome\<File name>.exe
- from %LOCALAPPDATA%\spchrome\user data\4770dae4-7a50-4668-aaf4-5d2658f03c03.tmp to %LOCALAPPDATA%\spchrome\user data\local state
- from %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\000001.dbtmp to %LOCALAPPDATA%\spchrome\user data\default\sync data\leveldb\current
- from %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\000001.dbtmp to %LOCALAPPDATA%\spchrome\user data\default\site characteristics database\current
- from %LOCALAPPDATA%\spchrome\user data\default\extension scripts\000001.dbtmp to %LOCALAPPDATA%\spchrome\user data\default\extension scripts\current
- from %LOCALAPPDATA%\spchrome\user data\default\code cache\wasm\index-dir\temp-index to %LOCALAPPDATA%\spchrome\user data\default\code cache\wasm\index-dir\the-real-index
- from %LOCALAPPDATA%\spchrome\user data\default\d70e56ab-2932-42e0-8fd0-a220a78c9d0b.tmp to %LOCALAPPDATA%\spchrome\user data\default\google profile.ico
- from %LOCALAPPDATA%\spchrome\user data\default\code cache\webui_js\index-dir\temp-index to %LOCALAPPDATA%\spchrome\user data\default\code cache\webui_js\index-dir\the-real-index
- from %LOCALAPPDATA%\spchrome\user data\default\code cache\js\index-dir\temp-index to %LOCALAPPDATA%\spchrome\user data\default\code cache\js\index-dir\the-real-index
- from %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\000001.dbtmp to %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\current
- from %LOCALAPPDATA%\spchrome\user data\default\google profile.ico to %LOCALAPPDATA%\spchrome\user data\default\google profile.ico~rfe4d83.tmp
- from %LOCALAPPDATA%\spchrome\user data\local state to %LOCALAPPDATA%\spchrome\user data\local state~rfe7399.tmp
- from %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\log to %LOCALAPPDATA%\spchrome\user data\default\local storage\leveldb\log.old
- from %LOCALAPPDATA%\spchrome\user data\browsermetrics-spare.pma.tmp to %LOCALAPPDATA%\spchrome\user data\browsermetrics-spare.pma
Substitutes the following files
- %LOCALAPPDATA%\spchrome\user data\default\google profile.ico
Network activity
Connects to
- 'localhost':49185
- 'wo##.#ptchrome.net':80
- 'localhost':49188
- 'localhost':49191
- 'dw.###chrome.net':80
- 'localhost':49194
- 'localhost':49197
- 'localhost':49200
- 'localhost':49203
- 'ch#####t.yhyhtech.com':88
- 'dn#.google':443
TCP
HTTP GET requests
- http://wo##.#ptchrome.net/mm/
- http://wo##.#ptchrome.net/afg/?pa################################################################################################################################################################...
- http://dw.###chrome.net/bropkg/GInstallerx64-155.exe
- http://11#.##8.135.32:88/spchrome/ciwl/?pa#######################################################################################################################################################...
- http://11#.##8.135.32:88/update/109.0.5414.155.php
Other
- 'localhost':49185
- 'localhost':49186
- 'localhost':49188
- 'localhost':49189
- 'localhost':49191
- 'localhost':49192
- 'localhost':49194
- 'localhost':49195
- 'localhost':49197
- 'localhost':49198
- 'localhost':49200
- 'localhost':49201
- 'localhost':49203
- 'localhost':49204
- 'dn#.google':443
UDP
- DNS ASK wo##.#ptchrome.net
- DNS ASK dw.###chrome.net
- DNS ASK ch#####t.yhyhtech.com
- DNS ASK dn#.google
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\SPChrome\User Data'
Creates and executes the following
- 'D:\program files\gptchrome\<File name>.exe' /auto /d "D:\Program Files\GptChrome"
- 'D:\program files\gptchrome\gptbrowser.exe' --type=renderer --extension-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --time-ti...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=renderer --extension-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ti...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1308,i,4797615630917526674,3600537882926...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3804 --field-trial-handle=1308,i,4797615630917...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3028 --field-trial-handle=1308,i,4797615630917526674,36...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2880 --field-trial-handle=1308,i,47...
- 'D:\program files\gptchrome\109.0.5414.155\7za.exe' x "D:\Program Files\GptChrome\109.0.5414.155\icudtlex.dat" -o"%LOCALAPPDATA%\SPChrome\User Data\SpExtension" -aoa -t7z -y -p"Xoenfwieol"
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1496 --field-trial-handle=1256,i,14...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-17048475...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-17048475...
- 'D:\program files\gptchrome\gptbrowser.exe' --no-startup-window
- 'D:\program files\gptchrome\gptbrowser.exe' --type=renderer --first-renderer-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-170...
- 'D:\program files\gptchrome\gptchromeservice.exe'
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1660 --field-trial-handle=1308,i,4797615630917526674,36...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1484 --field-trial-handle=1308,i,47...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAA...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\SPChrome\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\SPChrome\...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\SPChrome\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=%...
- 'D:\program files\gptchrome\gptbrowser.exe'
- 'D:\program files\gptchrome\7za.exe' x "D:\Program Files\GptChrome\GInstallerPkg" -o"D:\Program Files\GptChrome" -aoa -t7z -y
- 'D:\program files\gptchrome\gptbrowser.exe' --type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\SPChrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\SPChrome\User Data\Crashpad" ...
- 'D:\program files\gptchrome\gptbrowser.exe' --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 --field-trial-handle=1308,i,4797615630917526674,3600537882...
- 'D:\program files\gptchrome\spupdate.exe' /autocheck
- 'D:\program files\gptchrome\109.0.5414.155\7za.exe' x "D:\Program Files\GptChrome\109.0.5414.155\icudtlex.dat" -o"%LOCALAPPDATA%\SPChrome\User Data\SpExtension" -aoa -t7z -y -p"Xoenfwieol"' (with hidden window)
- 'D:\program files\gptchrome\gptbrowser.exe' ' (with hidden window)
- 'D:\program files\gptchrome\7za.exe' x "D:\Program Files\GptChrome\GInstallerPkg" -o"D:\Program Files\GptChrome" -aoa -t7z -y' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\explorer.exe' "D:\Program Files\GptChrome\GptBrowser.exe"
