PUP.BruteForce
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 0 |
| First Seen: | April 12, 2012 |
| OS(es) Affected: | Windows |
The detection of PUP.BruteForce on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's security and performance. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is PUP.BruteForce?
PUP.BruteForce is a type of malware that is designed to carry out brute-force attacks, which involve repeatedly trying different combinations of usernames and passwords to gain unauthorized access to systems, networks, or applications. While the name PUP.BruteForce suggests a specific functionality, it is crucial to note that the actual behavior and impact of this malware may vary. As a PUP, it may not be as malicious as other types of malware, but it can still pose a significant risk to your system's security and stability.
How PUP.BruteForce Operates
Once installed on your system, PUP.BruteForce may operate in the background, consuming system resources and potentially causing performance issues. It may also communicate with its command and control servers to receive updates, send stolen data, or receive instructions from its operators. The malware may use various techniques to evade detection, such as code obfuscation, anti-debugging, and sandbox evasion. It is also possible that PUP.BruteForce may be bundled with other malware or PUPs, which can further compromise your system's security.
Symptoms of Infection
The symptoms of a PUP.BruteForce infection may vary, but common indicators include slow system performance, increased CPU usage, and unusual network activity. You may also notice that your system is crashing or freezing frequently, or that your browser is being redirected to unwanted websites. In some cases, you may receive alerts from your security software or system administrators about suspicious activity on your system. It is essential to be vigilant and monitor your system's behavior to detect any potential security threats.
- Slow system performance
- Increased CPU usage
- Unusual network activity
- System crashes or freezes
- Browser redirection
- Security alerts from software or system administrators
How to Remove PUP.BruteForce
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.BruteForce and other related malware.
- Uninstall any suspicious programs or applications that may be related to the malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan to ensure that all remnants of the malware have been removed.
Conclusion
Removing PUP.BruteForce from your system requires careful attention to detail and a comprehensive approach to ensure that all instances of the malware are eliminated. By following the steps outlined above and maintaining good security practices, such as keeping your operating system and software up to date, using strong passwords, and avoiding suspicious downloads, you can help prevent future infections and protect your system from potential security threats.
Analysis Report
General information
| Family Name: | PUP.BruteForce |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
541f7e9a915df33c1d3b6a4f65973772
SHA1:
365acd23b964f0b44568a06e35b5a355fefa29b8
File Size:
3.70 MB, 3695104 bytes
|
|
MD5:
ee624f2c369582653ecc6580ace6eb77
SHA1:
c0fe7304f033380beded065988f10c90b87c4271
File Size:
1.97 MB, 1966592 bytes
|
|
MD5:
73638f19c7072491fa14aa0a2a7d293e
SHA1:
76e9732c04eb893612ad55cadeaf388b3b48bd65
File Size:
1.91 MB, 1907712 bytes
|
|
MD5:
a5a59fb147270b17eb75b2c6ef420e5f
SHA1:
145b979988c1e1b9c19b63ff6650ca351f59eeac
SHA256:
9096D4EE46BBCCF0FD4AD33566E774FB7C756FE28CCDFC71A8FDCC619EA89976
File Size:
3.13 MB, 3131392 bytes
|
|
MD5:
40a3f6a0d7f1f382b09bd82338a1c976
SHA1:
011314e9971a515f24c1109557f5b8e1f9799576
SHA256:
0893962E1174ED914E2753602D43F2B8D64109C7B74D0E2CC23E6B82CBEC10F1
File Size:
107.52 KB, 107520 bytes
|
Show More
|
MD5:
d45c0b34d95d321db5230b5b364a4dc0
SHA1:
7bc26166eba7c33e56cc811085eb71b0ab078c52
SHA256:
21BB7E27EAD4EDDE7D94290BDCF2F2EA7B00BBF15EFDBE9FBC010565D2DC86BC
File Size:
8.12 MB, 8116224 bytes
|
|
MD5:
12dbd0173f1523a99548d7f05fdd7921
SHA1:
2e6d9834145eda0032b464ad4152791fa6fa0abc
SHA256:
909A2C8B5B9977B016FCFA8D5C987540FAFDDFC38B889CF8EE867A500D5CC163
File Size:
181.76 KB, 181760 bytes
|
|
MD5:
684c16559c118e4007eb72b4beca3a54
SHA1:
f9ff84c7bf9c67fe392611bb86a6ede2885a51c8
SHA256:
4654FA24C346084FB9525AEDE4C1F6738C0B3F9E410264010278C6D237AB94D0
File Size:
245.50 KB, 245504 bytes
|
|
MD5:
d93c09a79b27873d5c3e249cc4625443
SHA1:
d15f0d737075ef86708f8ab8c118306928c182ed
SHA256:
6C748305E8B2AF6329E9F7A83B7B43DC4D33BF6E9F14E25E312EB31E28CBF2C4
File Size:
2.90 MB, 2904304 bytes
|
|
MD5:
3656aaa52383467a4f0aa5103619164e
SHA1:
3e2ae1d604da45fe333c70360323c3c328a13750
SHA256:
51F8E0941EFB35054E39B6953774A61E130A111715343CA4090E95DD33FFB2D7
File Size:
33.79 KB, 33792 bytes
|
|
MD5:
d7cfddf818be0208b1818a5c0ebac95f
SHA1:
429b477a08ec6f01e55ef1840d60de1fd32cace3
SHA256:
C69D673C552917DEFA0FC2510FD432CCDE197DED1C3E660742377698CE560470
File Size:
7.98 MB, 7979008 bytes
|
|
MD5:
30d1e4610d36ff5bce0296ba6b9d6ade
SHA1:
79d2f7fa1347b9783e53a6a38f7d97c661caadca
SHA256:
E873C1986C9BA2F236A8CAD24AEDAFE6080D81AC2D952620FD70620A48C3C562
File Size:
180.74 KB, 180736 bytes
|
|
MD5:
70d9b50549fe8e921da6c48b8a5183b7
SHA1:
23835894774e296027c2bce7a3020d7eace3f110
SHA256:
FBD59CF92BB5511B40CF64141FFEBD7DCE088CBA030B7119465A673020BDFD4D
File Size:
117.76 KB, 117760 bytes
|
|
MD5:
f0698d54d30e5cecab6d4a4c1ed2f571
SHA1:
60ac8668de84f9a862bdc7260eaf817d3c17a061
SHA256:
C084406CF72543A845F77EAB5B64AD995E6C93BFD7E1327FCAF5710C87828A35
File Size:
200.70 KB, 200704 bytes
|
|
MD5:
116948fa4610beb6766595a4e76345db
SHA1:
21085539e15a23c04264a4761cfb09a4da939555
SHA256:
8A582762ADEA7C673B8E74A77CFCAA39FAA466B7866FEF2A5F94BBBB1F1BAE24
File Size:
147.46 KB, 147456 bytes
|
|
MD5:
8293098b8dc38a42e8bb31f4394c94c7
SHA1:
6a01c7003ec0cd4eec71fbbd6ba0bd5bcac62391
SHA256:
B76A8EBA2D887616B635F54944EE3C6AF1CC351DAEB9470F42DDB5980A619CE9
File Size:
11.78 KB, 11776 bytes
|
|
MD5:
34ae7d945df7dbda0c42031c3d1444e3
SHA1:
6ee932c4485f822c7aa98bd631b707d4b5e35faa
SHA256:
3CAB2E97E722F29862ABED478E910E95EF7D7784AF542A2252C047C60F098A10
File Size:
9.16 MB, 9163236 bytes
|
|
MD5:
6634a687a49656fd3c3c56aeeec7132a
SHA1:
7fcc0b7664e162996e18d7346456a19ffe446e21
SHA256:
DB5CDAC3AFFD34EC3FD1F5C98434DCB61A9AF867E63E35A3128F4DC58D4DD3C6
File Size:
174.59 KB, 174592 bytes
|
|
MD5:
77a4d7fc5360c614ac34bba6a5a97461
SHA1:
41abf501542be4f66a898d61a9b510b1cae646c2
SHA256:
9C966410AA0BE9F5E7383CB36CCE73E7F7D9B8A106E570C83FFE01CA27E6957D
File Size:
1.94 MB, 1944673 bytes
|
|
MD5:
89e29605c4971b5355cfbdf9a92c8d08
SHA1:
5108d70d92b7843b83e8303e5c30f2ad01a8e200
SHA256:
E2BBF067587D87CC8EA73642EE3391F2926B06D98E9D66B0056A74F86ABF34CB
File Size:
5.72 MB, 5722140 bytes
|
|
MD5:
70c4b5c697b56d81dd07553186c80449
SHA1:
6dfc73d23e5629920f8e83e70e9693b4931d16c2
SHA256:
12709FBECA0746DECF4050950F1A6AD87E4256B20357F199B4E35F06476BAEC1
File Size:
823.32 KB, 823316 bytes
|
|
MD5:
80a2c3675f15d288d5bf1250ec28f823
SHA1:
1be6882ba974980a56704c4dc3eb9193a6dc63a5
SHA256:
AACD7729D1B4FDF0158EE2CE6DE1617F03D52EAAC1351DC7B01075490D6DD945
File Size:
156.67 KB, 156672 bytes
|
|
MD5:
544acd8fa683384a4a76b3a423cc23f0
SHA1:
2b4cbe1f22cebbac8a5f55b8abb7431c617a843d
SHA256:
4C38B3F883E06EA3F10679724836E06D83BB62B07F7625A83700C0A9DC306CC8
File Size:
175.10 KB, 175104 bytes
|
|
MD5:
c584999cbc61e03935d1c45bdb31e73f
SHA1:
6e63a21cbce85fe83ebb52345a0636f9cc2b8575
SHA256:
194DAE49EB0B29AEA93937328F78949023DBD11427A1A8D4B5C172B7D5B1B14B
File Size:
156.67 KB, 156672 bytes
|
|
MD5:
e2dccfcda162949635107c2d3290c494
SHA1:
c32819aa9ab1df050adb7ea9ceaf5287a4f753b5
SHA256:
C99F8763A43BB692E15B0DD70BCB5963926AC3CED33EC2836EDF36CC32E6C65E
File Size:
102.46 KB, 102458 bytes
|
|
MD5:
f7bd5abfc351db554b80407f6580471e
SHA1:
3de1a51ca74d9887ae7b855826c0ceac82a3fe43
SHA256:
1CCEDC66BB8FCCCF5D4E07DC16C21C91EDA837DCDD20786AE8099FC530C94335
File Size:
420.35 KB, 420352 bytes
|
|
MD5:
4899ca3fe34900bea52f09ea3307a635
SHA1:
e78e29df8dda5b22ff5b24aad0569d89339abd6c
SHA256:
59A23788B0F0101BD626DE11FA9FECD2F21091044104C10845C497D601813E09
File Size:
3.98 MB, 3981824 bytes
|
|
MD5:
038e1f04f9f87433d07ac8a536d6e394
SHA1:
845a6ade9a6e5ef4dc48b0abad621694b4801825
SHA256:
D9C450A665D78C23710895EAC9578DB3E14023120F438C6D514069B489B61BFA
File Size:
5.76 MB, 5764511 bytes
|
|
MD5:
19db1249add05297d1ae2b1cb6031df7
SHA1:
dfccea88aec80dd26ecc56dd09642f9827628d02
SHA256:
BC9BDD354A2750917506B20CC55E58F005097A6C1DB4E4211B1585D40F2DFE4B
File Size:
5.96 MB, 5959928 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| Original File Name | Sclient Installer.exe |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| MaherWin_2024-1-6_13-10-14 | MaherWin_2024-1-6_13-10-14 | Self Signed |
| Anteco Systems SL | Microsoft Identity Verification Root Certificate Authority 2020 | Root Not Trusted |
| Test certificate for 'Dota2-Minify [OSS]' | Test certificate for 'Dota2-Minify [OSS]' | Self Signed |
File Traits
- .NET
- 00 section
- 2+ executable sections
- AdvInst
- Agile.net
- big overlay
- dll
- Fody
- fptable
- HighEntropy
Show More
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
- NewLateBinding
- nosig nsis
- No Version Info
- ntdll
- Nullsoft Installer
- Py-installer
- VirtualQueryEx
- WriteProcessMemory
- x64
- x86
- zlib (In Overlay)
- zlib overlay
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 912 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 912 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
2
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Downloader.Agent.RCC
- MSIL.PSW.Agent.PC
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\tempdet | Synchronize,Write Attributes |
| c:\tempdet\__tmp_rar_sfx_access_check_3104671 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\tempdet\atualizador.exe | Generic Write,Read Attributes |
| c:\tempdet\atualizador.exe | Synchronize,Write Attributes |
| c:\tempdet\cab.exe | Generic Write,Read Attributes |
| c:\tempdet\cab.exe | Synchronize,Write Attributes |
| c:\tempdet\winrar.exe | Generic Write,Read Attributes |
| c:\tempdet\winrar.exe | Synchronize,Write Attributes |
| c:\users\public\microsoftedgeupdates.zip | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\public\microsoftedgeupdates\ps.vbs | Generic Write,Read Attributes |
Show More
| c:\users\public\microsoftedgeupdates\pss.bat | Generic Write,Read Attributes |
| c:\users\public\microsoftedgeupdates\s.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\aa06f0f1-832c-43f5-a57f-0741ec35be24\agiledotnetrt64.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-1851t.tmp\6dfc73d23e5629920f8e83e70e9693b4931d16c2_0000823316.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-l0slu.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-l0slu.tmp\_isetup\_shfoldr.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsr7813.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsr7813.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~nsua.tmp\au_.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 鲓 ȁ 龡^ 獖} | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Encryption Used |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
| Keyboard Access |
|
| Process Shell Execute |
|
| Other Suspicious |
|
| Network Info Queried |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
(NULL) c:\TEMPDET\Atualizador.exe
|
"C:\Users\Rwgkfwkd\AppData\Local\Temp\is-1851T.tmp\6dfc73d23e5629920f8e83e70e9693b4931d16c2_0000823316.tmp" /SL5="$40306,304640,304640,c:\users\user\downloads\6dfc73d23e5629920f8e83e70e9693b4931d16c2_0000823316"
|
"C:\Users\Urlzzzxc\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=c:\users\user\downloads\
|
