ida2

ida2

Figure 3 - Abuse of SchRpcCreateFolder to change the permissions of the Google Updater executable