Trojan.Agent.Gen.GAO

Trojan.Agent.Gen.GAO is a generic detection name used to identify a trojan-type threat that behaves in ways consistent with other malicious programs grouped under the broad "Agent" family. Detections labeled "Gen" typically mean the file was flagged based on behavioral or heuristic patterns rather than an exact, previously cataloged signature. This means Trojan.Agent.Gen.GAO may represent a variety of malicious files that share similar code structures, functions, or behaviors rather than a single, specific piece of malware.

Because detailed technical specifics about this particular detection are not confirmed, the description below reflects the typical behavior of trojans in this category, which commonly perform these actions once active on a system.

What This Threat Typically Does

Trojans classified under generic "Agent" detections commonly run quietly in the background without the user's knowledge or consent. Typical behavior for this type of threat includes:

• Downloading and installing additional malicious components onto the infected device
• Modifying system settings or configuration files to maintain persistence
• Communicating with a remote server controlled by attackers to receive instructions
• Collecting information from the infected machine, such as system details or browsing activity
• Disabling or interfering with security tools to avoid detection and removal

The exact capabilities of any individual file flagged as Trojan.Agent.Gen.GAO can vary, since the detection is heuristic-based and may apply to multiple unrelated malicious files sharing common traits.

How It Usually Gets Onto Computers

Trojans in this category typically spread through methods common to the broader trojan class, including:

• Email attachments or links in phishing messages disguised as legitimate documents or invoices
• Bundled installers for free or pirated software, including cracks and keygens
• Fake software updates or misleading download buttons on untrustworthy websites
• Malicious advertisements that redirect users to infected downloads
• Infected removable drives or peer-to-peer file sharing networks

Risks for the User

If left on a system, a trojan like this can expose users to several risks, including data theft, unauthorized remote access, financial loss, and further infections from additional malware it may download. Because trojans often operate silently, users may not immediately notice any impact, allowing attackers extended access to the compromised system.

Signs of Infection

Since this detection is generic, visible symptoms can vary widely, but typical warning signs associated with trojans include:

• Noticeable system slowdowns or increased CPU/network usage without a clear cause
• Unexpected pop-ups, error messages, or changes to browser or system settings
• New or unfamiliar programs appearing without the user's installation
• Security software being disabled or unable to update
• Unusual outbound network connections

How to Stay Protected

To reduce the risk of infection from threats like Trojan.Agent.Gen.GAO, users should keep their operating system and all installed software updated, avoid downloading programs from unverified or pirated sources, be cautious with email attachments and links from unknown senders, and use reputable security software to scan and monitor the system regularly. Maintaining regular backups of important files can also minimize damage in case of infection, while practicing safe browsing habits significantly lowers the chances of encountering such threats in the first place.

Analysis Report

General information

Family Name:	Trojan.Agent.Gen.GAO
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 3f8fa75718b6d1b443b788a68cfdaf1e SHA1: 099349795fbbf59074b55926818ee554273f3ca9 SHA256: 94069806A751BEADB67663DA37D0CB0697AB3D19A6E27F1E2118875BA17EAAC5 File Size: 55.30 KB, 55296 bytes

MD5: 1def2ec226d667dece04162bdf7b9b69 SHA1: 1b1aae6f2f2c4373b6d8be7d22422f8787fa28a1 SHA256: 72FF3D5068252BD439E2E79570EAE5257B0D3E07E37FC72D62435B9D502514A2 File Size: 5.17 MB, 5168536 bytes

MD5: 3bd531b321f08ef5501d1ec55038de8c SHA1: b030529a53a28dc7ef446504d922f8c776d815ca SHA256: 5F697E07061A96F8992E99159DE97E1BC138721C1392883AA5539055823F3388 File Size: 94.21 KB, 94208 bytes

MD5: 227605ff386c71a5d69d9432c8f949e6 SHA1: 4f7dddf2ee63504ed184dea93a06b79fda07ca3c SHA256: E924AAA1BAB4778ABDBF57E8221CF9DB18541B3938B62CD889687A0966FEB23B File Size: 5.17 MB, 5168024 bytes

MD5: ec7a05ef89ff68f112bf923118260f5c SHA1: 23ca76f90e851dc835f83549e90e1eee384bb80f SHA256: 1B8151524C8301EBC8AE0A7A8014565B91F02D73D28155239F7426729A3128C9 File Size: 56.83 KB, 56832 bytes

Show 17 more

MD5: 33517d4315b7f11ba5ae31bb670cf347 SHA1: 11b3fa207dd73a227938d24aa1512d6075de7a5e SHA256: E777B6AC97F30DC299D7048FCF6D43924877E903B86C022119948FB481F70304 File Size: 111.62 KB, 111616 bytes

MD5: 324d27885f3e6b90ddba16af5d9d84ff SHA1: 64b852faf97f5c495dea36bede169df35eec3f21 SHA256: E09CBE04EFA621460FB4B762B59BB0D8690C19E861C7D746DFB17413F5F85533 File Size: 55.30 KB, 55296 bytes

MD5: e875ab3729a3e82185887c5d34f7dc9c SHA1: 8c92ca417ac660782fc079c795435cbaf8b0fc2a SHA256: BEAA4375C1037AF7BCFB4BEF0430534E7208B4019192D7044E3D10D6E11E8B41 File Size: 154.11 KB, 154112 bytes

MD5: 4177457b86e1640e719ff76d13aa23fb SHA1: f1c6a0d8600e38a0fa022c352b4392b0575dbe05 SHA256: 7A4E35E69B61AF5FB929C5D60A8C8A999D45580A2D41FCD1B2B396232BF49E54 File Size: 115.20 KB, 115200 bytes

MD5: eeacf061f6cce9f75329c8e8c7d241a7 SHA1: 99ce4a71062649d6667bdab4a738f52ec638b80f SHA256: C324C439D7345E5C40EB125E9C225BADF51D6B80EB21C2388EABFCEF20E6AD02 File Size: 138.75 KB, 138752 bytes

MD5: 4bed748141def96a49ea843ad2c0e358 SHA1: e1c401a320b2936009d4c95181453a11228fc847 SHA256: 536CE4F6E104089EF01EBBFE222E88DA0D3E9A5E603CD7A2B4A36E5FEAA967CD File Size: 158.72 KB, 158720 bytes

MD5: 1b155cf172ad45e1f738ca004cc2740a SHA1: b41df9ef43c06219f4dcb60a23d35ad948306c95 SHA256: 1CAD85D7785CD5E2D9CE874EF3D994D84671A23EAABE5B5C3134341F6F3454E6 File Size: 109.57 KB, 109568 bytes

MD5: b772899e81d6709a5f56718120a32e1b SHA1: 0c995ebc393b361c4448777008b3c12bc314a544 SHA256: 8CBD2D2AF9BAA32B5001ED6D642CD4F9A68B68085D6DB586DDCEA39F049CE450 File Size: 482.30 KB, 482304 bytes

MD5: 50e5d80604f58f84e5654b59582df118 SHA1: bb18d10709f2b89dd9aa84e2e1657211e4011aa6 SHA256: D450385DAC9E278A47544037FCE9F01ADFBF708B4523183C4DCC67EDB9D1CDB3 File Size: 142.85 KB, 142848 bytes

MD5: 33bcf54bc6494980b58bee49bcfff325 SHA1: c68a90afca80b72d42ca18fec128b3789cf2bdcd SHA256: 67655D001A573D98ED83AFF5622DB11DE0C81771D409349F5B73F0CEA7BE9EFC File Size: 387.58 KB, 387584 bytes

MD5: f95c6f411fc46513a1e72e30f8ae6da2 SHA1: 6ce778155492cb3a6cbc9266bb80004ae8d760d7 SHA256: BF4C7CDA02D11A343169EC361A663570DA70D46AB28DFBB6BB60FE05602612DF File Size: 443.90 KB, 443904 bytes

MD5: 6352bcec69a9f6125724452ebf4214b6 SHA1: 2cc4e7882bf4a1f663108cba92ae81b646d3b0cb SHA256: 32B6651CF6E377FC2066259C6EA7FD27A2A95D0EB6E75B0DE5277B5998C523C5 File Size: 113.15 KB, 113152 bytes

MD5: 98df656b6602e89276b57b6a934af6da SHA1: 5dc520c401a53557d64198df5a57074fbf9f8f74 SHA256: 4390BB3647D6D132FC3BC0FDD18A5D73078A08AF712CCF0E7D65F031EF806D04 File Size: 112.64 KB, 112640 bytes

MD5: f2585c3aeba383cd60a66d993db8cc00 SHA1: ef180c5efb10dc9449a6975283245174b31ca8a8 SHA256: D3DD10AE5CE43A55B6DEBA4855B77E746B11E326C380DFAC43C75D8D7E91E81F File Size: 113.66 KB, 113664 bytes

MD5: 1dfad23df1f317c7bb2d83cefebb16b3 SHA1: 4713c634fab4e8c7153df349f7cd024d3c2c6b3a SHA256: 18A91B44B692827F97E0E6984B0C1BB55AFA326A1ED5500A19969104EBA7C8BB File Size: 471.55 KB, 471552 bytes

MD5: 583a7428831cb933781069f5e000489e SHA1: 738f416c8b310d5c06924b48b449ede152ef3bb7 SHA256: 62D0481B39EE2586D7E092B3AD3D9917202F5C0592E35098CFADE75B716DA460 File Size: 134.66 KB, 134656 bytes

MD5: 99c815808dc8eae6b32ff6fee673090e SHA1: 1de99a08ac9e1fb9462f3d0d47b165ea0ea9a1cf SHA256: 15A0FE6FB4512A39394D9898BB3EC1469CDBCBC4D4B45208D0927061E50D56FD File Size: 465.41 KB, 465408 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 64-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show 4 more

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Google LLC
File Description	Chrome Component (x86) Chrome Crash Handler (x86) Chrome Helper Component (x86) Google Installer (x86) Google Update Updater
File Version	152.0.8197.20 152.0.8161.96 152.0.8136.47 152.0.8132.69 152.0.8085.58 152.0.8030.82 152.0.7990.90 152.0.7945.34 152.0.7878.44 152.0.7850.98 Show 11 more 152.0.7829.23 152.0.7768.82 152.0.7751.12 152.0.7727.73 152.0.7667.19 152.0.7624.72 152.0.7610.68 152.0.7600.85 152.0.7583.64 152.0.7536.66 46.1.8905.0
Internal Name	chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_elf_host.exe chrome_extension.dll chrome_metrics_core.dll chrome_policy_core.dll Show 5 more Google Installer (x86) Google Update Updater guanchor64.dll gucore_host.dll gupdate_core.dll
Legal Copyright	Copyright 2026 Google LLC. All rights reserved.
Original Filename	Chrome.exe chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_elf_host.exe chrome_extension.dll chrome_metrics_core.dll Show 5 more chrome_policy_core.dll google.exe guanchor64.dll gucore_host.dll gupdate_core.dll
Product Name	chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_elf_host.exe chrome_extension.dll chrome_metrics_core.dll chrome_policy_core.dll Show 5 more Google Installer (x86) Google Update Updater guanchor64.dll gucore_host.dll gupdate_core.dll
Product Version	152.0.8197.20 152.0.8161.96 152.0.8136.47 152.0.8132.69 152.0.8085.58 152.0.8030.82 152.0.7990.90 152.0.7945.34 152.0.7878.44 152.0.7850.98 Show 11 more 152.0.7829.23 152.0.7768.82 152.0.7751.12 152.0.7727.73 152.0.7667.19 152.0.7624.72 152.0.7610.68 152.0.7600.85 152.0.7583.64 152.0.7536.66 46.1.8905.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Google LLC	Google LLC	Self Signed

File Traits

• dll
• GetConsoleWindow
• HighEntropy
• Installer Version
• WriteProcessMemory
• x64

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	2,978
Potentially Malicious Blocks:	630
Whitelisted Blocks:	753
Unknown Blocks:	1,595

Visual Map

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Trojan.Agent.Gen.FQJ
• Trojan.Agent.Gen.GAO
• Trojan.Agent.Gen.GPQ
• Trojan.Kryptik.Gen.KLV
• Trojan.Kryptik.Gen.KYR

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe	Read Attributes,Synchronize,Write Attributes

Show 10 more

c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.3.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.4.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.5.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.6.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\google\chrome\bwhkcggxry::ldr	x �}xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ���	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::lsz	雒	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::isz	�p	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::udir	C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140	"C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry\chrome140.exe" /user	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::ldr	x �}xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ���	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::lsz	雒	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::isz	�p	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::udir	C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140	"C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj\chrome140.exe" /user	RegNtPreCreateKey

Show 4 more

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n % �v����Bx(�1`1�1HO@V�A��H[uN$ _�zb"hk`k�ql(�{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~� �=�SB1_T�Vw�`�V �R���%�� �������AE��D��&��$���L A	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n  �vT���Bx(�(X�1`1�1HO@V�H[ub"hk`k�ql(�{b��P���� ����������.�m�Ù�����$ წ��� �=�SB1_T�Vw�`�V �R���%�������AE��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n $ �vT�����&� (�(X�1`1�1HO@V�A��H[u_�zb"hk`k�qtǤ{b��P���� ��7 ����������.�m�Ù��IV����$ �8წ���Κ�&M�=�SB1_T�Vw�`�V ��%�������AE�zH ��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n * �v�Z����Bx#�� (�1`1�1HO@V�H[uH�pN$ _�zb"hk`k�ql(�{b��P���! �/��Hu��� ����3 ���������X����m�Ù��gi �V����$ �8წ���l�A �~�=�SB1_B��T�Vw���%�� �������AE��D��&��	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPort ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtCancelWaitCompletionPacket ntdll.dll!NtClose Show 73 more ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryTimerResolution ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadRequestData ntdll.dll!NtReadVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTerminateProcess ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Service Control	OpenSCManager OpenService
Encryption Used	BCryptOpenAlgorithmProvider
Keyboard Access	GetAsyncKeyState GetKeyState
Network Winsock	getaddrinfo
Network Winhttp	WinHttpOpen
User Data Access	GetUserName
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\ProgramData\Google\Client State\qa89w4pa\ChromeInstaller.exe"

"C:\ProgramData\Google\Client State\45ku5mbl\chrome_installer_setup.exe"