威胁数据库 特洛伊木马 Trojan.Agent.Gen.GAO

Trojan.Agent.Gen.GAO

通过CagedTech在 特洛伊木马
发布时间：
最后更新：

威胁评分卡

人气排名： 6,238
威胁级别： 80 % (高的)
受感染的计算机： 41
初见： September 26, 2026
最后一次露面： October 22, 2026
受影响的操作系统： Windows

Trojan.Agent.Gen.GAO是一个通用检测名称，用于识别行为方式与其他归类于“Agent”家族的恶意程序一致的木马类威胁。标记为“Gen”的检测结果通常表示该文件是基于行为或启发式模式而非精确的、先前已编目的特征码而被标记的。这意味着 Trojan.Agent.Gen.GAO 可能代表多种具有相似代码结构、功能或行为的恶意文件，而不是单个特定的恶意软件。

由于尚未确认有关此特定检测的详细技术细节，以下描述反映了此类木马的典型行为，此类木马一旦在系统上激活，通常会执行这些操作。

这种威胁通常会造成什么后果？

被归类为通用“代理”检测的木马程序通常会在用户不知情或未经用户同意的情况下静默运行。此类威胁的典型行为包括：

  • 在受感染的设备上下载并安装其他恶意组件
  • 修改系统设置或配置文件以保持持久性
  • 与攻击者控制的远程服务器通信以接收指令
  • 从受感染的计算机收集信息，例如系统详细信息或浏览活动。
  • 禁用或干扰安全工具以避免被检测和移除

任何被标记为 Trojan.Agent.Gen.GAO 的单个文件的具体功能可能有所不同，因为检测是基于启发式的，并且可能适用于具有共同特征的多个不相关的恶意文件。

它通常是如何进入电脑的

此类木马通常通过木马类普遍采用的传播方式进行传播，包括：

  • 钓鱼邮件中的附件或链接伪装成合法文件或发票
  • 捆绑式安装程序，用于免费或盗版软件，包括破解程序和注册机
  • 不可信网站上的虚假软件更新或误导性下载按钮
  • 恶意广告会将用户重定向到受感染的下载页面
  • 受感染的移动硬盘或点对点文件共享网络

用户面临的风险

如果将此类木马程序留在系统中，可能会使用户面临多种风险，包括数据被盗、未经授权的远程访问、经济损失，以及可能下载的其他恶意软件造成的进一步感染。由于木马程序通常静默运行，用户可能不会立即察觉任何影响，从而使攻击者能够更长时间地访问受感染的系统。

感染迹象

由于这种检测方法是通用的，因此可见症状可能差异很大，但与木马程序相关的典型警告信号包括：

  • 系统运行速度明显变慢或 CPU/网络使用率增加，但无明显原因。
  • 意外弹出窗口、错误消息或浏览器或系统设置更改
  • 未经用户安装而出现的新程序或不熟悉的程序
  • 安全软件被禁用或无法更新
  • 异常的出站网络连接

如何做好防护

为了降低感染 Trojan.Agent.Gen.GAO 等威胁的风险，用户应保持操作系统和所有已安装软件的更新，避免从未经核实或盗版来源下载程序，谨慎对待来自未知发件人的电子邮件附件和链接，并使用信誉良好的安全软件定期扫描和监控系统。定期备份重要文件也能最大限度地减少感染造成的损失，而养成安全的浏览习惯则能显著降低遭遇此类威胁的几率。

分析报告

一般信息

姓： Trojan.Agent.Gen.GAO
签名状态： No Signature

已知样本

MD5: 3f8fa75718b6d1b443b788a68cfdaf1e
SHA1: 099349795fbbf59074b55926818ee554273f3ca9
SHA256: 94069806A751BEADB67663DA37D0CB0697AB3D19A6E27F1E2118875BA17EAAC5
文件大小: 55.30 KB,55296字节
MD5: 1def2ec226d667dece04162bdf7b9b69
SHA1: 1b1aae6f2f2c4373b6d8be7d22422f8787fa28a1
SHA256: 72FF3D5068252BD439E2E79570EAE5257B0D3E07E37FC72D62435B9D502514A2
文件大小: 5.17 MB,5168536字节
MD5: 3bd531b321f08ef5501d1ec55038de8c
SHA1: b030529a53a28dc7ef446504d922f8c776d815ca
SHA256: 5F697E07061A96F8992E99159DE97E1BC138721C1392883AA5539055823F3388
文件大小: 94.21 KB,94208字节
MD5: 227605ff386c71a5d69d9432c8f949e6
SHA1: 4f7dddf2ee63504ed184dea93a06b79fda07ca3c
SHA256: E924AAA1BAB4778ABDBF57E8221CF9DB18541B3938B62CD889687A0966FEB23B
文件大小: 5.17 MB,5168024字节
MD5: ec7a05ef89ff68f112bf923118260f5c
SHA1: 23ca76f90e851dc835f83549e90e1eee384bb80f
SHA256: 1B8151524C8301EBC8AE0A7A8014565B91F02D73D28155239F7426729A3128C9
文件大小: 56.83 KB,56832字节
Show 17 more
MD5: 33517d4315b7f11ba5ae31bb670cf347
SHA1: 11b3fa207dd73a227938d24aa1512d6075de7a5e
SHA256: E777B6AC97F30DC299D7048FCF6D43924877E903B86C022119948FB481F70304
文件大小: 111.62 KB,111616字节
MD5: 324d27885f3e6b90ddba16af5d9d84ff
SHA1: 64b852faf97f5c495dea36bede169df35eec3f21
SHA256: E09CBE04EFA621460FB4B762B59BB0D8690C19E861C7D746DFB17413F5F85533
文件大小: 55.30 KB,55296字节
MD5: e875ab3729a3e82185887c5d34f7dc9c
SHA1: 8c92ca417ac660782fc079c795435cbaf8b0fc2a
SHA256: BEAA4375C1037AF7BCFB4BEF0430534E7208B4019192D7044E3D10D6E11E8B41
文件大小: 154.11 KB,154112字节
MD5: 4177457b86e1640e719ff76d13aa23fb
SHA1: f1c6a0d8600e38a0fa022c352b4392b0575dbe05
SHA256: 7A4E35E69B61AF5FB929C5D60A8C8A999D45580A2D41FCD1B2B396232BF49E54
文件大小: 115.20 KB,115200字节
MD5: eeacf061f6cce9f75329c8e8c7d241a7
SHA1: 99ce4a71062649d6667bdab4a738f52ec638b80f
SHA256: C324C439D7345E5C40EB125E9C225BADF51D6B80EB21C2388EABFCEF20E6AD02
文件大小: 138.75 KB,138752字节
MD5: 4bed748141def96a49ea843ad2c0e358
SHA1: e1c401a320b2936009d4c95181453a11228fc847
SHA256: 536CE4F6E104089EF01EBBFE222E88DA0D3E9A5E603CD7A2B4A36E5FEAA967CD
文件大小: 158.72 KB,158720字节
MD5: 1b155cf172ad45e1f738ca004cc2740a
SHA1: b41df9ef43c06219f4dcb60a23d35ad948306c95
SHA256: 1CAD85D7785CD5E2D9CE874EF3D994D84671A23EAABE5B5C3134341F6F3454E6
文件大小: 109.57 KB,109568字节
MD5: b772899e81d6709a5f56718120a32e1b
SHA1: 0c995ebc393b361c4448777008b3c12bc314a544
SHA256: 8CBD2D2AF9BAA32B5001ED6D642CD4F9A68B68085D6DB586DDCEA39F049CE450
文件大小: 482.30 KB,482304字节
MD5: 50e5d80604f58f84e5654b59582df118
SHA1: bb18d10709f2b89dd9aa84e2e1657211e4011aa6
SHA256: D450385DAC9E278A47544037FCE9F01ADFBF708B4523183C4DCC67EDB9D1CDB3
文件大小: 142.85 KB,142848字节
MD5: 33bcf54bc6494980b58bee49bcfff325
SHA1: c68a90afca80b72d42ca18fec128b3789cf2bdcd
SHA256: 67655D001A573D98ED83AFF5622DB11DE0C81771D409349F5B73F0CEA7BE9EFC
文件大小: 387.58 KB,387584字节
MD5: f95c6f411fc46513a1e72e30f8ae6da2
SHA1: 6ce778155492cb3a6cbc9266bb80004ae8d760d7
SHA256: BF4C7CDA02D11A343169EC361A663570DA70D46AB28DFBB6BB60FE05602612DF
文件大小: 443.90 KB,443904字节
MD5: 6352bcec69a9f6125724452ebf4214b6
SHA1: 2cc4e7882bf4a1f663108cba92ae81b646d3b0cb
SHA256: 32B6651CF6E377FC2066259C6EA7FD27A2A95D0EB6E75B0DE5277B5998C523C5
文件大小: 113.15 KB,113152字节
MD5: 98df656b6602e89276b57b6a934af6da
SHA1: 5dc520c401a53557d64198df5a57074fbf9f8f74
SHA256: 4390BB3647D6D132FC3BC0FDD18A5D73078A08AF712CCF0E7D65F031EF806D04
文件大小: 112.64 KB,112640字节
MD5: f2585c3aeba383cd60a66d993db8cc00
SHA1: ef180c5efb10dc9449a6975283245174b31ca8a8
SHA256: D3DD10AE5CE43A55B6DEBA4855B77E746B11E326C380DFAC43C75D8D7E91E81F
文件大小: 113.66 KB,113664字节
MD5: 1dfad23df1f317c7bb2d83cefebb16b3
SHA1: 4713c634fab4e8c7153df349f7cd024d3c2c6b3a
SHA256: 18A91B44B692827F97E0E6984B0C1BB55AFA326A1ED5500A19969104EBA7C8BB
文件大小: 471.55 KB,471552字节
MD5: 583a7428831cb933781069f5e000489e
SHA1: 738f416c8b310d5c06924b48b449ede152ef3bb7
SHA256: 62D0481B39EE2586D7E092B3AD3D9917202F5C0592E35098CFADE75B716DA460
文件大小: 134.66 KB,134656字节
MD5: 99c815808dc8eae6b32ff6fee673090e
SHA1: 1de99a08ac9e1fb9462f3d0d47b165ea0ea9a1cf
SHA256: 15A0FE6FB4512A39394D9898BB3EC1469CDBCBC4D4B45208D0927061E50D56FD
文件大小: 465.41 KB,465408字节

Windows 可移植可执行文件属性

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show 4 more
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

文件图标

Windows PE 版本信息

姓名 价值
Company Name Google LLC
File Description
  • Chrome Component (x86)
  • Chrome Crash Handler (x86)
  • Chrome Helper Component (x86)
  • Google Installer (x86)
  • Google Update Updater
File Version
  • 152.0.8197.20
  • 152.0.8161.96
  • 152.0.8136.47
  • 152.0.8132.69
  • 152.0.8085.58
  • 152.0.8030.82
  • 152.0.7990.90
  • 152.0.7945.34
  • 152.0.7878.44
  • 152.0.7850.98
Show 11 more
  • 152.0.7829.23
  • 152.0.7768.82
  • 152.0.7751.12
  • 152.0.7727.73
  • 152.0.7667.19
  • 152.0.7624.72
  • 152.0.7610.68
  • 152.0.7600.85
  • 152.0.7583.64
  • 152.0.7536.66
  • 46.1.8905.0
Internal Name
  • chrome.exe
  • ChromeCrashReporter.exe
  • ChromeUpdatePolicy.dll
  • chrome_breakpad.dll
  • chrome_crashpad.dll
  • chrome_crash_daemon.exe
  • chrome_elf_host.exe
  • chrome_extension.dll
  • chrome_metrics_core.dll
  • chrome_policy_core.dll
Show 5 more
  • Google Installer (x86)
  • Google Update Updater
  • guanchor64.dll
  • gucore_host.dll
  • gupdate_core.dll
Legal Copyright Copyright 2026 Google LLC. All rights reserved.
Original Filename
  • Chrome.exe
  • chrome.exe
  • ChromeCrashReporter.exe
  • ChromeUpdatePolicy.dll
  • chrome_breakpad.dll
  • chrome_crashpad.dll
  • chrome_crash_daemon.exe
  • chrome_elf_host.exe
  • chrome_extension.dll
  • chrome_metrics_core.dll
Show 5 more
  • chrome_policy_core.dll
  • google.exe
  • guanchor64.dll
  • gucore_host.dll
  • gupdate_core.dll
Product Name
  • chrome.exe
  • ChromeCrashReporter.exe
  • ChromeUpdatePolicy.dll
  • chrome_breakpad.dll
  • chrome_crashpad.dll
  • chrome_crash_daemon.exe
  • chrome_elf_host.exe
  • chrome_extension.dll
  • chrome_metrics_core.dll
  • chrome_policy_core.dll
Show 5 more
  • Google Installer (x86)
  • Google Update Updater
  • guanchor64.dll
  • gucore_host.dll
  • gupdate_core.dll
Product Version
  • 152.0.8197.20
  • 152.0.8161.96
  • 152.0.8136.47
  • 152.0.8132.69
  • 152.0.8085.58
  • 152.0.8030.82
  • 152.0.7990.90
  • 152.0.7945.34
  • 152.0.7878.44
  • 152.0.7850.98
Show 11 more
  • 152.0.7829.23
  • 152.0.7768.82
  • 152.0.7751.12
  • 152.0.7727.73
  • 152.0.7667.19
  • 152.0.7624.72
  • 152.0.7610.68
  • 152.0.7600.85
  • 152.0.7583.64
  • 152.0.7536.66
  • 46.1.8905.0

数字签名

签名者 根 地位
Google LLC Google LLC Self Signed

文件特征

  • dll
  • GetConsoleWindow
  • HighEntropy
  • Installer Version
  • WriteProcessMemory
  • x64

区块信息

总区块数： 2,978
潜在恶意块： 630
白名单区块： 753
未知区块： 1,595

可视化地图

... 数据已截断
0 - 可能的保险箱
? - 未知区块
x - 潜在恶意拦截

相似家庭

文件已修改

文件 属性
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\chrome140.exe Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\google.dll Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupdt.exe Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\9j6f3k4wwj\gupw.exe Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\chrome140.exe Read Attributes,Synchronize,Write Attributes
Show 10 more
c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll Generic Write,Read Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\google.dll Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupdt.exe Read Attributes,Synchronize,Write Attributes
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\google\chrome\bwhkcggxry\gupw.exe Read Attributes,Synchronize,Write Attributes
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.3.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.4.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.5.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\ntuser.dat{53b39e87-18c4-11ea-a811-000d3aa4692b}.txr.6.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data

注册表修改

键::值 数据 API名称
HKCU\software\google\chrome\bwhkcggxry::ldr x�} xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp ?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ��� RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::lsz 雒 RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::isz �p RegNtPreCreateKey
HKCU\software\google\chrome\bwhkcggxry::udir C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140 "C:\Users\Lldqpajw\AppData\Local\Google\Chrome\bwhkcggxry\chrome140.exe" /user RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::ldr x�} xW�����$���(�C�6qd�Q;m�eI���mՒ'M;�m��%�G�\C�jp ?��p,���fYh��rhR���XJ[����i!��ͦK��s�G�]�Z �}�;��s�9��s�}�h�}�1B �%�aG3����r�c���%�]u���*�p(a�ţC�?�D�־�5��XC���g��**Jk^!X"d�aΓwXˌ�d�.��HH�e�V!R�F"\��x� ��� RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::lsz 雒 RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::isz �p RegNtPreCreateKey
HKCU\software\google\chrome\9j6f3k4wwj::udir C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::googleupdate140 "C:\Users\Rmegitxe\AppData\Local\Google\Chrome\9j6f3k4wwj\chrome140.exe" /user RegNtPreCreateKey
Show 4 more
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n% �v����Bx(�1`1�1HO@V�A��H[uN$_�zb"hk`k�ql(�{b��P���!���� ���3�����������m�Ù��V����$�8წ���l��&M�~��=�SB1_T�Vw�`�V�R���%���������AE��D��&��$���LA RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 n �vT���Bx(�(X�1`1�1HO@V�H[ub"hk`k�ql(�{b��P��������������.�m�Ù�����$წ����=�SB1_T�Vw�`�V�R���%�������AE��D��&��$���L RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n$ �vT�����&� (�(X�1`1�1HO@V�A��H[u_�zb"hk`k�qtǤ{b��P������7����������.�m�Ù��IV����$�8წ���Κ�&M�=�SB1_T�Vw�`�V��%�������AE�zH��D��&��$���L RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �n* �v �Z����Bx#��(�1`1�1HO@V�H[uH�pN$_�zb"hk`k�ql(�{b��P���!�/��Hu���� ���3���������X����m�Ù��gi�V����$�8წ���l�A�~�=�SB1_B��T�Vw���%���������AE��D��&�� RegNtPreCreateKey

Windows API 使用情况

类别 API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClose
Show 73 more
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryTimerResolution
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Service Control
  • OpenSCManager
  • OpenService
Encryption Used
  • BCryptOpenAlgorithmProvider
Keyboard Access
  • GetAsyncKeyState
  • GetKeyState
Network Winsock
  • getaddrinfo
Network Winhttp
  • WinHttpOpen
User Data Access
  • GetUserName
Process Shell Execute
  • CreateProcess

Shell命令执行

"C:\ProgramData\Google\Client State\qa89w4pa\ChromeInstaller.exe"
"C:\ProgramData\Google\Client State\45ku5mbl\chrome_installer_setup.exe"