| K7 Detection Name | Affected OS | Prevalence | AV Definition Version |
|---|---|---|---|
| Suspicious Program ( ID51546 ) | Windows | Low | 12.188.53233 |
| MD5 | 4ffe33b7f683695d0ee4c8a2133c5dd3 |
| SHA256 | 3a82f3dafe7edb3e6f71a87f2f016bc807d3496cf362e135ed71587635d56915 |
| File Size | 3,711,487 bytes |
| Packer Information | N/A |
| First Seen | 11-09-2024 |
| Last Seen | 08-07-2026 |
| Aliases | Generik.KYJPVCY |
Behavior Details
1. Creates Registry:
Adds data
0
under
HKEY_USERS\S-1-5-21-2160014781-3840829433-2341337948-1001\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr
Adds data
0
under
HKEY_USERS\S-1-5-21-2160014781-3840829433-2341337948-1001\SOFTWARE\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\dr
Adds data
Everyone
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\cohort\name
Adds data
1:2iqx:
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\(Default)
Adds data
main cohort
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\name
Adds data
Stable
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\name
Adds data
1:gu:3mff@0.01,3lzx@0.01
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\(Default)
Adds data
1:scr:3mdf@0.02,3lnf@0.0
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\cohort\(Default)
Adds data
-arch_x64-statsdef_1
under
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\ap
Removal Instructions
1. Update K7 security to the latest version.
2. Open Windows registry editor and delete the following keys:
HKEY_USERS\S-1-5-21-2160014781-3840829433-2341337948-1001\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\dr
HKEY_USERS\S-1-5-21-2160014781-3840829433-2341337948-1001\SOFTWARE\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\ap
3. Restart the machine.