Trojan.Agent.Gen.GAO

Trojan.Agent.Gen.GAO is a generic detection name used to identify a trojan-type threat that behaves in ways consistent with other malicious programs grouped under the broad "Agent" family. Detections labeled "Gen" typically mean the file was flagged based on behavioral or heuristic patterns rather than an exact, previously cataloged signature. This means Trojan.Agent.Gen.GAO may represent a variety of malicious files that share similar code structures, functions, or behaviors rather than a single, specific piece of malware.

Because detailed technical specifics about this particular detection are not confirmed, the description below reflects the typical behavior of trojans in this category, which commonly perform these actions once active on a system.

What This Threat Typically Does

Trojans classified under generic "Agent" detections commonly run quietly in the background without the user's knowledge or consent. Typical behavior for this type of threat includes:

• Downloading and installing additional malicious components onto the infected device
• Modifying system settings or configuration files to maintain persistence
• Communicating with a remote server controlled by attackers to receive instructions
• Collecting information from the infected machine, such as system details or browsing activity
• Disabling or interfering with security tools to avoid detection and removal

The exact capabilities of any individual file flagged as Trojan.Agent.Gen.GAO can vary, since the detection is heuristic-based and may apply to multiple unrelated malicious files sharing common traits.

How It Usually Gets Onto Computers

Trojans in this category typically spread through methods common to the broader trojan class, including:

• Email attachments or links in phishing messages disguised as legitimate documents or invoices
• Bundled installers for free or pirated software, including cracks and keygens
• Fake software updates or misleading download buttons on untrustworthy websites
• Malicious advertisements that redirect users to infected downloads
• Infected removable drives or peer-to-peer file sharing networks

Risks for the User

If left on a system, a trojan like this can expose users to several risks, including data theft, unauthorized remote access, financial loss, and further infections from additional malware it may download. Because trojans often operate silently, users may not immediately notice any impact, allowing attackers extended access to the compromised system.

Signs of Infection

Since this detection is generic, visible symptoms can vary widely, but typical warning signs associated with trojans include:

• Noticeable system slowdowns or increased CPU/network usage without a clear cause
• Unexpected pop-ups, error messages, or changes to browser or system settings
• New or unfamiliar programs appearing without the user's installation
• Security software being disabled or unable to update
• Unusual outbound network connections

How to Stay Protected

To reduce the risk of infection from threats like Trojan.Agent.Gen.GAO, users should keep their operating system and all installed software updated, avoid downloading programs from unverified or pirated sources, be cautious with email attachments and links from unknown senders, and use reputable security software to scan and monitor the system regularly. Maintaining regular backups of important files can also minimize damage in case of infection, while practicing safe browsing habits significantly lowers the chances of encountering such threats in the first place.

Analysis Report

General information

Family Name:	Trojan.Agent.Gen.GAO
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 3f8fa75718b6d1b443b788a68cfdaf1e SHA1: 099349795fbbf59074b55926818ee554273f3ca9 SHA256: 94069806A751BEADB67663DA37D0CB0697AB3D19A6E27F1E2118875BA17EAAC5 File Size: 55.30 KB, 55296 bytes

MD5: 1def2ec226d667dece04162bdf7b9b69 SHA1: 1b1aae6f2f2c4373b6d8be7d22422f8787fa28a1 SHA256: 72FF3D5068252BD439E2E79570EAE5257B0D3E07E37FC72D62435B9D502514A2 File Size: 5.17 MB, 5168536 bytes

MD5: 3bd531b321f08ef5501d1ec55038de8c SHA1: b030529a53a28dc7ef446504d922f8c776d815ca SHA256: 5F697E07061A96F8992E99159DE97E1BC138721C1392883AA5539055823F3388 File Size: 94.21 KB, 94208 bytes

MD5: 227605ff386c71a5d69d9432c8f949e6 SHA1: 4f7dddf2ee63504ed184dea93a06b79fda07ca3c SHA256: E924AAA1BAB4778ABDBF57E8221CF9DB18541B3938B62CD889687A0966FEB23B File Size: 5.17 MB, 5168024 bytes

MD5: ec7a05ef89ff68f112bf923118260f5c SHA1: 23ca76f90e851dc835f83549e90e1eee384bb80f SHA256: 1B8151524C8301EBC8AE0A7A8014565B91F02D73D28155239F7426729A3128C9 File Size: 56.83 KB, 56832 bytes

Show 35 more

MD5: 33517d4315b7f11ba5ae31bb670cf347 SHA1: 11b3fa207dd73a227938d24aa1512d6075de7a5e SHA256: E777B6AC97F30DC299D7048FCF6D43924877E903B86C022119948FB481F70304 File Size: 111.62 KB, 111616 bytes

MD5: 324d27885f3e6b90ddba16af5d9d84ff SHA1: 64b852faf97f5c495dea36bede169df35eec3f21 SHA256: E09CBE04EFA621460FB4B762B59BB0D8690C19E861C7D746DFB17413F5F85533 File Size: 55.30 KB, 55296 bytes

MD5: e875ab3729a3e82185887c5d34f7dc9c SHA1: 8c92ca417ac660782fc079c795435cbaf8b0fc2a SHA256: BEAA4375C1037AF7BCFB4BEF0430534E7208B4019192D7044E3D10D6E11E8B41 File Size: 154.11 KB, 154112 bytes

MD5: 4177457b86e1640e719ff76d13aa23fb SHA1: f1c6a0d8600e38a0fa022c352b4392b0575dbe05 SHA256: 7A4E35E69B61AF5FB929C5D60A8C8A999D45580A2D41FCD1B2B396232BF49E54 File Size: 115.20 KB, 115200 bytes

MD5: eeacf061f6cce9f75329c8e8c7d241a7 SHA1: 99ce4a71062649d6667bdab4a738f52ec638b80f SHA256: C324C439D7345E5C40EB125E9C225BADF51D6B80EB21C2388EABFCEF20E6AD02 File Size: 138.75 KB, 138752 bytes

MD5: 4bed748141def96a49ea843ad2c0e358 SHA1: e1c401a320b2936009d4c95181453a11228fc847 SHA256: 536CE4F6E104089EF01EBBFE222E88DA0D3E9A5E603CD7A2B4A36E5FEAA967CD File Size: 158.72 KB, 158720 bytes

MD5: 1b155cf172ad45e1f738ca004cc2740a SHA1: b41df9ef43c06219f4dcb60a23d35ad948306c95 SHA256: 1CAD85D7785CD5E2D9CE874EF3D994D84671A23EAABE5B5C3134341F6F3454E6 File Size: 109.57 KB, 109568 bytes

MD5: b772899e81d6709a5f56718120a32e1b SHA1: 0c995ebc393b361c4448777008b3c12bc314a544 SHA256: 8CBD2D2AF9BAA32B5001ED6D642CD4F9A68B68085D6DB586DDCEA39F049CE450 File Size: 482.30 KB, 482304 bytes

MD5: 50e5d80604f58f84e5654b59582df118 SHA1: bb18d10709f2b89dd9aa84e2e1657211e4011aa6 SHA256: D450385DAC9E278A47544037FCE9F01ADFBF708B4523183C4DCC67EDB9D1CDB3 File Size: 142.85 KB, 142848 bytes

MD5: 33bcf54bc6494980b58bee49bcfff325 SHA1: c68a90afca80b72d42ca18fec128b3789cf2bdcd SHA256: 67655D001A573D98ED83AFF5622DB11DE0C81771D409349F5B73F0CEA7BE9EFC File Size: 387.58 KB, 387584 bytes

MD5: f95c6f411fc46513a1e72e30f8ae6da2 SHA1: 6ce778155492cb3a6cbc9266bb80004ae8d760d7 SHA256: BF4C7CDA02D11A343169EC361A663570DA70D46AB28DFBB6BB60FE05602612DF File Size: 443.90 KB, 443904 bytes

MD5: 6352bcec69a9f6125724452ebf4214b6 SHA1: 2cc4e7882bf4a1f663108cba92ae81b646d3b0cb SHA256: 32B6651CF6E377FC2066259C6EA7FD27A2A95D0EB6E75B0DE5277B5998C523C5 File Size: 113.15 KB, 113152 bytes

MD5: 98df656b6602e89276b57b6a934af6da SHA1: 5dc520c401a53557d64198df5a57074fbf9f8f74 SHA256: 4390BB3647D6D132FC3BC0FDD18A5D73078A08AF712CCF0E7D65F031EF806D04 File Size: 112.64 KB, 112640 bytes

MD5: f2585c3aeba383cd60a66d993db8cc00 SHA1: ef180c5efb10dc9449a6975283245174b31ca8a8 SHA256: D3DD10AE5CE43A55B6DEBA4855B77E746B11E326C380DFAC43C75D8D7E91E81F File Size: 113.66 KB, 113664 bytes

MD5: 1dfad23df1f317c7bb2d83cefebb16b3 SHA1: 4713c634fab4e8c7153df349f7cd024d3c2c6b3a SHA256: 18A91B44B692827F97E0E6984B0C1BB55AFA326A1ED5500A19969104EBA7C8BB File Size: 471.55 KB, 471552 bytes

MD5: 583a7428831cb933781069f5e000489e SHA1: 738f416c8b310d5c06924b48b449ede152ef3bb7 SHA256: 62D0481B39EE2586D7E092B3AD3D9917202F5C0592E35098CFADE75B716DA460 File Size: 134.66 KB, 134656 bytes

MD5: 99c815808dc8eae6b32ff6fee673090e SHA1: 1de99a08ac9e1fb9462f3d0d47b165ea0ea9a1cf SHA256: 15A0FE6FB4512A39394D9898BB3EC1469CDBCBC4D4B45208D0927061E50D56FD File Size: 465.41 KB, 465408 bytes

MD5: 223042fe2b9c794fb88d05dd4c81fb12 SHA1: ca7a607e23f7a62a307c0529932d1eb4c6dddc91 SHA256: EE1C788943340B1DF3635877380F53FD8A827B21042780FFC1E85AE410FFB150 File Size: 109.57 KB, 109568 bytes

MD5: 0646da4ff3903fb91df841dfd3d0fe5a SHA1: 3e5116c8728ba5c17b882febd81d96d83d3ba263 SHA256: 6D008113CB3AB79499C69609E0E8873C2147BB6C58414F06BCDBF0B5D0E738A3 File Size: 115.20 KB, 115200 bytes

MD5: 393daac342c1bf12bba7f49814e11cd4 SHA1: f66ffd5a9ae96305c92c0f021c8631109f8bec4e SHA256: BC93F2782DAC7C167FD6D5846025A2C92136C319E0E6F8B53920E8482CBAB7C2 File Size: 115.20 KB, 115200 bytes

MD5: 5b3d1a6f193a03bd8145bdb61d6a9e08 SHA1: 81c314029170e323808b668abfedfadc6b49a6f4 SHA256: DEF68899DD9B27F8570C8AAF33DE254951F08DD0D65407E6865F741C0B56E5F6 File Size: 108.54 KB, 108544 bytes

MD5: 77fd3558cd3c8d42c5c82026ab275030 SHA1: 2e751c5bbcc4acd0a0d51c03d6bd2c6c29f30a3a SHA256: 263073184C911806532FD1EEF5476604DD5585C97D4D318340B427ABC7C40228 File Size: 106.50 KB, 106496 bytes

MD5: f5d0c7e19b6fbefa289264cf8e4ad044 SHA1: 5e055d52f9e23a9e95a4dfacdd76744e8a6a8207 SHA256: 2886EA392355F48DE5D74F1910361ECAAB0B0350486B0F998DCB2994B998693E File Size: 90.11 KB, 90112 bytes

MD5: d289fdd50a47ab211728af216d6fcf59 SHA1: 123f1eb7e745b2f6ee1bf58f74aa0359dee49089 SHA256: D71A3CA7C2C5204A51EB0700F6B57463E9B4FA4ADF61491024552FC811E2A185 File Size: 163.84 KB, 163840 bytes

MD5: c0dbbb241806b392b455c90803017111 SHA1: 5bf776d82a1b42020d5866ca4aed6847f0875b84 SHA256: D1DDC83A993E1F569E3A7873DA4F34BF6E136091029D331428B299519552E5AC File Size: 110.08 KB, 110080 bytes

MD5: a045d5da283b996b8b0d2201dbff1183 SHA1: be3a18faac1b8fbf3c60dd5e252aaf74d36ba440 SHA256: D954CC6F0AD5F4AAF513D9C16918650D03148D4894850A0DB1D6822C29698221 File Size: 116.22 KB, 116224 bytes

MD5: 5e509d7e9e30f6bb8c1046587f548ba0 SHA1: 6d34db4c1a357ddd621a53901f11df8eedee424d SHA256: C4358ACD6418B77F45E82A0EC8C81009C284958EC4CFFC6F8B2AAC90E5E37CC3 File Size: 111.62 KB, 111616 bytes

MD5: 6f3684f3e865d5691266c6441783af37 SHA1: 0f43703632bc388cbdc742d9d49b457b8b8a9ae2 SHA256: 870CA6B7240A1059C6B34C2D850BAB89C0E935495CAAB979FF41B29C37DE5BBE File Size: 110.08 KB, 110080 bytes

MD5: deab0eb287fcb8dc6aec6febf142bf62 SHA1: ca0a5f452e98341b3504c546ada3b71d2099d469 SHA256: 35421F79B0AC02F1A9D3AF864199A0D052F15E3B67C7C84BFD5D76CC6210AF3A File Size: 111.62 KB, 111616 bytes

MD5: ac447573b71497755b674422a09b9550 SHA1: 6688043fd1549626e3c43f80834b88138e126807 SHA256: 37E97AAEDEA6BB464FCFACFB94BCB15B3D427F91CAB29714EE212EF51A75E58A File Size: 113.15 KB, 113152 bytes

MD5: 484f375bbf3d89c1c2546b218feaa38f SHA1: 08390c1acebae42a422f28b465fb4e0932a7ea7d SHA256: 2885B187CB61299F63041E2152DBACFEE55DDE67FBF303C72224E4CD3DABB7E0 File Size: 110.59 KB, 110592 bytes

MD5: c1be17076baf2e6f4c5ed214a7c67dd0 SHA1: 9dcbf60f128e0636ec12b4562bc8aafa9fabc3a9 SHA256: 0766D52474B5CC7ABEC3E9049E1BB989180B83F20C6351E6D5BB958D67A7A7BA File Size: 315.90 KB, 315904 bytes

MD5: aac03d4999ff4a3b4306deb6853978a6 SHA1: 698b2fd7a29ccb2a8c56a2388d50883e658178cc SHA256: 7F26E37849F0E87126389E89033CAFCDA88468EAF442FB9307E79BC33678AADF File Size: 109.06 KB, 109056 bytes

MD5: 6d37441041bcdc44fd263b57561ad617 SHA1: 8a058659b8ddb023c1083542996e18be97f1e6ce SHA256: 3856C875672351FDDFCF79B40B434EAC457A8F536EFF7962D2B1A35EECED5D67 File Size: 116.74 KB, 116736 bytes

MD5: 5c9376b413f2a0076ba70a365c1c2ad3 SHA1: bf88dce8942ce007b1192bf85c3e5a29f402bcf6 SHA256: 79B8D715BD20F9BAFF2F6DF9EE3626B673D77184850DCFE1A3FCD0DC383040C2 File Size: 109.57 KB, 109568 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 64-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show 4 more

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Google LLC
File Description	Chrome Component (x86) Chrome Crash Handler (x86) Chrome Helper Component (x86) Google Installer (x86) Google Update Engine (x86) Google Update Updater
File Version	154.0.8037.98 152.0.8296.35 152.0.8197.20 152.0.8161.96 152.0.8142.3 152.0.8136.47 152.0.8132.69 152.0.8125.13 152.0.8089.81 152.0.8085.58 Show 29 more 152.0.8073.59 152.0.8055.92 152.0.8030.82 152.0.8027.3 152.0.7990.90 152.0.7955.74 152.0.7948.89 152.0.7945.34 152.0.7879.42 152.0.7878.44 152.0.7850.98 152.0.7829.23 152.0.7828.8 152.0.7768.82 152.0.7752.48 152.0.7751.12 152.0.7727.73 152.0.7724.27 152.0.7694.48 152.0.7667.19 152.0.7624.72 152.0.7618.58 152.0.7610.68 152.0.7600.85 152.0.7583.64 152.0.7536.66 152.0.7512.73 148.0.7778.56 46.1.8905.0
Internal Name	chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_crash_service.exe chrome_elf.dll chrome_elf_host.exe chrome_extension.dll Show 10 more chrome_frame.dll chrome_metrics_core.dll chrome_policy_core.dll chrome_update_core.dll Google Installer (x86) Google Update Updater guanchor.dll guanchor64.dll gucore_host.dll gupdate_core.dll
Legal Copyright	Copyright 2026 Google LLC. All rights reserved.
Original Filename	Chrome.exe chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_crash_service.exe chrome_elf.dll chrome_elf_host.exe Show 10 more chrome_extension.dll chrome_frame.dll chrome_metrics_core.dll chrome_policy_core.dll chrome_update_core.dll google.exe guanchor.dll guanchor64.dll gucore_host.dll gupdate_core.dll
Product Name	chrome.exe ChromeCrashReporter.exe ChromeUpdatePolicy.dll chrome_breakpad.dll chrome_crashpad.dll chrome_crash_daemon.exe chrome_crash_service.exe chrome_elf.dll chrome_elf_host.exe chrome_extension.dll Show 10 more chrome_frame.dll chrome_metrics_core.dll chrome_policy_core.dll chrome_update_core.dll Google Installer (x86) Google Update Updater guanchor.dll guanchor64.dll gucore_host.dll gupdate_core.dll
Product Version	154.0.8037.98 152.0.8296.35 152.0.8197.20 152.0.8161.96 152.0.8142.3 152.0.8136.47 152.0.8132.69 152.0.8125.13 152.0.8089.81 152.0.8085.58 Show 29 more 152.0.8073.59 152.0.8055.92 152.0.8030.82 152.0.8027.3 152.0.7990.90 152.0.7955.74 152.0.7948.89 152.0.7945.34 152.0.7879.42 152.0.7878.44 152.0.7850.98 152.0.7829.23 152.0.7828.8 152.0.7768.82 152.0.7752.48 152.0.7751.12 152.0.7727.73 152.0.7724.27 152.0.7694.48 152.0.7667.19 152.0.7624.72 152.0.7618.58 152.0.7610.68 152.0.7600.85 152.0.7583.64 152.0.7536.66 152.0.7512.73 148.0.7778.56 46.1.8905.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Google LLC	Google LLC	Self Signed

File Traits

• dll
• GetConsoleWindow
• HighEntropy
• Installer Version
• WriteProcessMemory
• x64

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	608
Potentially Malicious Blocks:	82
Whitelisted Blocks:	486
Unknown Blocks:	40

Visual Map

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Trojan.Agent.Gen.FQJ
• Trojan.Agent.Gen.GAO
• Trojan.Agent.Gen.GPQ
• Trojan.Kryptik.Gen.KLV
• Trojan.Kryptik.Gen.KYR

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\programdata\google\update\154.0.8037.98\chromeupdatestate.dat	Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Show 11 more

c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe	Read Attributes,Synchronize,Write Attributes
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.3.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.4.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.5.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.6.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\google\chrome\bwhkcggxry::ldr	x �}xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ���	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::lsz	雒	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::isz	�p	RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::udir	C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140	"C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry\chrome140.exe" /user	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::ldr	x �}xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ���	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::lsz	雒	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::isz	�p	RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::udir	C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140	"C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj\chrome140.exe" /user	RegNtPreCreateKey

Show 4 more

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n % �v����Bx(�1`1�1HO@V�A��H[uN$ _�zb"hk`k�ql(�{b��P���! ��� ����3 �����������m�Ù��V����$ �8წ���l��&M�~� �=�SB1_T�Vw�`�V �R���%�� �������AE��D��&��$���L A	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n  �vT���Bx(�(X�1`1�1HO@V�H[ub"hk`k�ql(�{b��P���� ����������.�m�Ù�����$ წ��� �=�SB1_T�Vw�`�V �R���%�������AE��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n $ �vT�����&� (�(X�1`1�1HO@V�A��H[u_�zb"hk`k�qtǤ{b��P���� ��7 ����������.�m�Ù��IV����$ �8წ���Κ�&M�=�SB1_T�Vw�`�V ��%�������AE�zH ��D��&��$���L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n * �v�Z����Bx#�� (�1`1�1HO@V�H[uH�pN$ _�zb"hk`k�ql(�{b��P���! �/��Hu��� ����3 ���������X����m�Ù��gi �V����$ �8წ���l�A �~�=�SB1_B��T�Vw���%�� �������AE��D��&��	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcConnectPort ntdll.dll!NtAlpcConnectPortEx ntdll.dll!NtAlpcQueryInformation ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtAssociateWaitCompletionPacket ntdll.dll!NtCancelWaitCompletionPacket Show 78 more ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateIoCompletion ntdll.dll!NtCreateKey ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateTimer2 ntdll.dll!NtCreateWaitCompletionPacket ntdll.dll!NtCreateWorkerFactory ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtNotifyChangeKey ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtPowerInformation ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryTimerResolution ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReadRequestData ntdll.dll!NtReadVirtualMemory ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationObject ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSetTimer2 ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTerminateProcess ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile ntdll.dll!NtYieldExecution UNKNOWN
Service Control	OpenSCManager OpenService
Encryption Used	BCryptOpenAlgorithmProvider
Keyboard Access	GetAsyncKeyState GetKeyState
Network Winsock	getaddrinfo
Network Winhttp	WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest
User Data Access	GetUserName
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\ProgramData\Google\Client State\qa89w4pa\ChromeInstaller.exe"

"C:\ProgramData\Google\Client State\45ku5mbl\chrome_installer_setup.exe"

"C:\ProgramData\Google\Update\154.0.8037.98\chrome_service64.exe"