Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.AEEC

PUP.Gamehack.AEEC

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.AEEC on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it to prevent any potential harm.

What Is PUP.Gamehack.AEEC?

PUP.Gamehack.AEEC is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on suspicious links.

How PUP.Gamehack.AEEC Operates

PUP.Gamehack.AEEC, like other PUPs, can operate in various ways to achieve its goals. It may display unwanted advertisements, collect user data, or install additional malware on the system. In some cases, it may also attempt to modify system settings or registry entries to maintain its presence on the system. The primary goal of PUPs is often to generate revenue for their creators, usually through advertising or by selling user data.

Symptoms of Infection

The symptoms of a PUP.Gamehack.AEEC infection can vary, but common signs include unwanted pop-ups or advertisements, slow system performance, and unexpected changes to system settings. You may also notice that your browser homepage or search engine has been changed without your consent. In some cases, you may experience crashes or freezes, especially if the PUP is consuming system resources.

  • Unwanted advertisements or pop-ups
  • Slow system performance
  • Changes to system settings or browser configurations
  • Crashes or freezes
  • Unexplained data usage or network activity

How to Remove PUP.Gamehack.AEEC

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a clean removal process.
  2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This will help identify and remove all components of the PUP.
  3. Uninstall any suspicious programs that you do not recognize or that were installed around the time the PUP was detected.
  4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any changes made by the PUP.
  5. Reboot your system and perform another scan with your anti-malware tool to ensure that all components of the PUP have been removed.

Conclusion

Removing PUP.Gamehack.AEEC from your system is crucial to maintaining your privacy and ensuring your computer's security and performance. By following the steps outlined above, you can effectively remove this potentially unwanted program and prevent future infections. It's also important to practice safe computing habits, such as avoiding suspicious downloads and links, to reduce the risk of PUP infections. Regularly updating your operating system, browser, and security software can also help protect against the latest threats.

Analysis Report

General information

Family Name: PUP.Gamehack.AEEC
Signature status: No Signature

Known Samples

MD5: fd91498d2d15dbeabd459fdca844bc91
SHA1: b5dc8d6dd176e7c280701c263879bffe3b754c5a
SHA256: CB964D47359CFF94420BAE755E5580F6E15AEE1C5E604D840782CA6EA3A45DA6
File Size: 1.64 MB, 1637380 bytes
MD5: 9a8e52c6eb57fce31bcf807ee7db7fa9
SHA1: a969af70802404e66c883a191eb3a54d2425a479
SHA256: 40C05F03FB08651A13D5E52D47DD63E5A3451DD2B39FFEA7031D24E9322A50F4
File Size: 347.14 KB, 347136 bytes
MD5: 014311e9a00a39ae54df62f4575adfae
SHA1: 02ccb258d0f9910b2df63f1c3cafe292ee373874
SHA256: BD094A9AB09CC4C88037E3E1F51F9B659FD70A12CD34F3B6F77CAB53E1DB703D
File Size: 421.89 KB, 421888 bytes
MD5: 1e1a923a63ac605dc1c97548e7410561
SHA1: be2c9c51e7776e0b5aa00e60533bc7ff7e8bd828
SHA256: C02D694FB82AD90B1E85C2BE83B545ECCF768634C59DBF633AE0E07BE60C50C4
File Size: 2.38 MB, 2383208 bytes
MD5: d39ad9595fec7bd35c47f8f3c4be99db
SHA1: 9c25999905021dc0e0746c9537576d8613c28c28
SHA256: 4CB72DA4C8B80FD114D54D885988FC762F150D87E3DAF8111B0B7B4E39BEE43E
File Size: 706.56 KB, 706560 bytes
Show More
MD5: 31280f778700a7dca1b1849fac8bd7ca
SHA1: 5031698d7d7648831e36cae433a08abe7149acfd
SHA256: 35EC593E7F3FCA4F80AE5C94D5A245EF4694FABB70B03C2EE18A30B43E15AEC7
File Size: 1.66 MB, 1660928 bytes
MD5: d4da986caa93a7c06b9b56e0ed59422d
SHA1: 591c493e848ba465e47b18d22af3ad463ced415d
SHA256: 14021633D5DCB44C1A7917FEE5265FDB8FEE3AA3CF41EE199E6D5CE84970E5DE
File Size: 4.01 MB, 4012544 bytes
MD5: 3b841930dbc88c7bc40f602fda2dedf7
SHA1: 63f1552f98f9c6163d16ecdc1ef46d525c14c0b6
SHA256: 58D58741A187C1EF81D308F91054827A8F53EE7C58FB1054E9A95EDF89F85ABC
File Size: 1.53 MB, 1534464 bytes
MD5: 38f62588b73e86223740ad84f4e3d853
SHA1: d73b5da3b9af71bc72ce8d0b015efec468c3c7db
SHA256: E90212C428178502A44069AD02D80F6FBAD25BC452CA581B45CC377A67A4CDFA
File Size: 2.10 MB, 2097138 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has been packed
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is 64-bit executable
Show More
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Company Name
  • Microsoft
  • Tsuda Kageyu
File Description MinHook - The Minimalistic API Hook Library for x64/x86
File Version
  • 1.3.3.0
  • 1.00
Internal Name
  • MinHookD
  • Win
Legal Copyright Copyright (C) 2009-2017 Tsuda Kageyu. All rights reserved.
Legal Trademarks Tsuda Kageyu
Original Filename Win.exe
Product Name
  • MinHook DLL
  • Win
Product Version
  • 1.3.3.0
  • 1.00

Digital Signatures

Signer Root Status
Gaston Dallavalle SSL.com Root Certification Authority RSA Root Not Trusted

File Traits

  • 2+ executable sections
  • big overlay
  • dll
  • GetConsoleWindow
  • HighEntropy
  • imgui
  • No Version Info
  • packed
  • upx
  • UPX!
Show More
  • VirtualQueryEx
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 2,411
Potentially Malicious Blocks: 85
Whitelisted Blocks: 2,122
Unknown Blocks: 204

Visual Map

x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? ? 0 0 0 0 0 ? 0 ? 0 ? ? ? ? 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? 0 ? ? ? 0 ? 1 ? 0 0 0 0 x ? ? ? 0 x x 0 x 0 0 ? 0 0 x x 0 0 1 0 0 1 0 0 x 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x x 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? 0 0 ? ? ? 0 x 0 0 0 0 ? x 0 x 0 ? 0 0 x 0 ? 0 0 ? x 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 ? ? x 0 0 0 ? 0 ? ? ? ? 0 0 ? 0 ? x x 0 0 0 0 0 ? ? 1 0 ? 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 x 0 0 x 0 0 x x 0 x 0 0 ? 0 0 0 0 1 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x ? 0 ? 0 0 0 0 0 0 x ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 1 0 0 ? ? x 0 ? 0 0 x 0 0 x 0 0 1 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 ? 0 0 0 0 x 0 0 0 0 0 0 0 ? 0 0 1 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 x 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x 0 0 x 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 x 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 x x x 0 0 0 0 ? x 0 0 0 0 x x 0 0 0 ? x 0 x 0 0 0 0 x x x 0 0 0 ? 0 0 0 0 x 1 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 x 0 ? 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 x 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 ? 0 0 ? 0 0 ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 ? 0 0 1 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 ? 0 ? ? 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? ? ? ? 0 0 ? ? 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 1 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • CsgoInjector.RC
  • DiscordStealer.AE
  • Downloader.Agent.BTF
  • Gamehack.AEEC
  • Gamehack.GDDB

Files Modified

File Attributes
\device\namedpipe Generic Read,Write Attributes
\device\namedpipe Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 jB +� xy�5Bx#@�#��%:�%f�1HO1�D6�^9�9ߔ>3�@V�@��A��N$R20`�2g��n�ArnJu�~x�y�y�^{�=���P��ރ�����7�b:����������6��T��T��a ���48�T�����T�� [�m�Ù��a���p�'��IV�gi�t����$�>�[� RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe 滘炲ǜ RegNtPreCreateKey
HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.1!7::name szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION RegNtPreCreateKey
HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.2!7::name szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION RegNtPreCreateKey
HKLM\software\microsoft\cryptography\oid\encodingtype 0\cryptdllfindoidinfo\1.3.6.1.4.1.311.60.3.3!7::name szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL RegNtPreCreateKey

Windows API Usage

Category API
Other Suspicious
  • SetWindowsHookEx
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAllocateLocallyUniqueId
  • ntdll.dll!NtAllocateReserveObject
  • ntdll.dll!NtAlpcAcceptConnectPort
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreatePort
  • ntdll.dll!NtAlpcCreateSecurityContext
Show More
  • ntdll.dll!NtAlpcDeleteSecurityContext
  • ntdll.dll!NtAlpcOpenSenderProcess
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateNamedPipeFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDelayExecution
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFindAtom
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenMutant
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryObject
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRemoveIoCompletionEx
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetIoCompletionEx
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSetValueKey
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId

7 additional items are not displayed above.

User Data Access
  • GetComputerName
  • GetComputerNameEx
Process Shell Execute
  • CreateProcess
Process Manipulation Evasion
  • NtUnmapViewOfSection
Network Winsock2
  • WSAStartup
Network Winsock
  • accept
  • bind
  • closesocket
  • connect
  • getsockname
  • recv
  • send
  • setsockopt
  • socket
Keyboard Access
  • GetAsyncKeyState

Shell Command Execution

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /c certutil -hashfile "c:\users\user\downloads\02ccb258d0f9910b2df63f1c3cafe292ee373874_0000421888" MD5 | find /i /v "md5" | find /i /v "certutil"
C:\WINDOWS\system32\certutil.exe certutil -hashfile "c:\users\user\downloads\02ccb258d0f9910b2df63f1c3cafe292ee373874_0000421888" MD5
C:\WINDOWS\system32\find.exe find /i /v "md5"
C:\WINDOWS\system32\find.exe find /i /v "certutil"

Related Posts

Trending

Most Viewed

Loading...