Threat Database Potentially Unwanted Programs PUP.Gamehack.GADB

PUP.Gamehack.GADB

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.GADB on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.

What Is PUP.Gamehack.GADB?

PUP.Gamehack.GADB is a type of malware that is classified as a potentially unwanted program. This means that it may not be as malicious as other types of malware, such as viruses or trojans, but it can still cause problems with your system. PUPs are often installed unintentionally by users, and they can lead to a range of issues, including slowed system performance, unwanted ads, and data collection.

How PUP.Gamehack.GADB Operates

PUP.Gamehack.GADB, like other PUPs, can operate in various ways. It may be installed as a standalone program or as part of a software bundle. Once installed, it can start to collect data, display unwanted ads, or even modify system settings. PUPs can also be used to distribute other types of malware, making them a significant threat to system security. It is crucial to remove PUP.Gamehack.GADB as soon as possible to prevent further damage.

Symptoms of Infection

Identifying the symptoms of a PUP infection can be challenging, as they can be similar to those caused by other types of malware. However, some common signs of a PUP infection include slowed system performance, unwanted ads or pop-ups, unfamiliar programs or toolbars, and modified system settings. If you have noticed any of these symptoms, it is essential to take action to remove the PUP and prevent further damage.

  • Unwanted ads or pop-ups
  • Slowed system performance
  • Unfamiliar programs or toolbars
  • Modified system settings

How to Remove PUP.Gamehack.GADB

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more effective removal process.
  2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs.
  3. Uninstall any suspicious programs or applications that may be related to the PUP.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons.
  5. Reboot your system and perform another scan to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Gamehack.GADB from your system is crucial to prevent further damage and ensure your system's security. By following the steps outlined above, you can effectively remove the PUP and prevent future infections. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when installing new software, to prevent similar infections in the future. Remember to always use reputable anti-malware tools and keep your system and software up to date to stay protected against the latest threats.

Analysis Report

General information

Family Name: PUP.Gamehack.GADB
Signature status: No Signature

Known Samples

MD5: 94aa268e3532523be43587bfbaf4ab8b
SHA1: da9259ed4d2e9a4d389b8081f6c9c58ccbc19485
SHA256: 4D42BB1AA7F7764F2168B0C7C23F0C0BCF303D8843A9B4CDC355D565EFB64460
File Size: 350.21 KB, 350208 bytes
MD5: 18afaa472fb8fb9c9786193dff06f3fa
SHA1: a34e61cd4e76601076975b965034f7ce601f4134
SHA256: 66BD473BDA7A7208CECD43767F780F76ACDEE34E5DB0B49E7419DDCB1FE2DFD6
File Size: 631.30 KB, 631296 bytes
MD5: 6d19a65a5cca76d707e526e828cea8fd
SHA1: 6c4637c8edce34e38eb466b9840200608718891c
SHA256: FA1E2809A35E0CA678E2B516FD99EB9EA14C4B310A0D56EE2998E6434A5F28A7
File Size: 357.89 KB, 357888 bytes
MD5: 42b6f7765c7e55de741d2bee827babbd
SHA1: 94e61662faed5accea1b384858ee13b0668c2ff6
SHA256: A2C389CD08D558CD8B92C5C31D23C5911D890FAE7D26CCC30D5CA4A39AD85DB3
File Size: 482.82 KB, 482816 bytes
MD5: 7a62250e54bd29150400492af8817215
SHA1: cbde33e81ae4f13844da23dde39a707fc705cb7a
SHA256: 655D9EC9BD962DCEC556622BFB1F1D3954FF850B2B2A569C6D5B5EE3A58B378D
File Size: 1.32 MB, 1317376 bytes
Show More
MD5: 344e6b3aa2b347d75e1c4f5f016a3e28
SHA1: a02e83121cef3358d8e67fa66e03c9bb3dd37eca
SHA256: 066F0FCD24D1BF7AFED3A4D079A40F72EF0BD84FC6377C142EA2FE92E8682ABC
File Size: 415.23 KB, 415232 bytes
MD5: 44ff64a64a93d6a10900b8be832f138f
SHA1: 3b91d4731ead15c03b9ceeb6ea5a756151855122
SHA256: 3D7841DA964BD25D4EE6DB6BFBEEC664C33935039C67EC5F50D5CF371D7ED648
File Size: 760.32 KB, 760320 bytes
MD5: fa7d089196576450c19b2a1c84be40cf
SHA1: a0faaf8a867e0c4fba6d002caf9d03a621eee3ed
SHA256: 01EF238C5D73CC7CBA5F7C3FEFA1E2C0B3EF893A4A1F8CA6A5606BAA227247FB
File Size: 515.07 KB, 515072 bytes
MD5: 7c374c9ea1140bd8385286ed9ce7ac13
SHA1: b72fc13a4f3566bdcfeeb3fb7383537ee5b9a28e
SHA256: 1F0DDB4FAFE953BE282F61E352A6460BC34B64C60D5AC1E92E3026F64B9F503A
File Size: 432.64 KB, 432640 bytes
MD5: 8c9d74a7c44180370796b67319779266
SHA1: 1d4b91906b424616799f146252f5a68d4f375703
SHA256: B3D7C6CACF3A4FACB858AD90DC4FD1C5DE1F3D432A1079D943067F5541F0E98C
File Size: 548.86 KB, 548864 bytes
MD5: 35bca7cd227c8d04e8bb8733141d5817
SHA1: e78ad15473e874a3af1d75650fd83fc5005cb72a
SHA256: 8B58BFDC981E25031DD498EE27DAD7FE6E0306BE5BA6F6B4F6D775618E57D288
File Size: 384.00 KB, 384000 bytes
MD5: b038e2757834618702d0558bc332e2fc
SHA1: 1381e6de146ef077de0a0142279ec732fae10613
SHA256: 86DBDEB70C8A3DC759ED4FACF52565EE40A94125E1268428780E5144386C59BA
File Size: 870.40 KB, 870400 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Company Name
  • ermaccer
  • GitHub: Taiga74164
File Description
  • DR3Hook
  • SoloLevelling Cheat
File Version
  • 1.0.0.0
  • 0.1.0.0
Internal Name
  • DR3Hook
  • SoloLevelling.dll
Legal Copyright Copyright (C) 2023
Original Filename
  • DR3Hook
  • SoloLevelling.dll
Product Name
  • DR3Hook
  • SoloLevelling
Product Version
  • 1.0.0.0
  • 0.1.0.0

File Traits

  • dll
  • GetConsoleWindow
  • HighEntropy
  • imgui
  • No Version Info
  • ntdll
  • VirtualQueryEx
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 1,812
Potentially Malicious Blocks: 153
Whitelisted Blocks: 1,482
Unknown Blocks: 177

Visual Map

? x 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? x ? x ? ? ? ? ? x ? ? ? ? ? x 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 x 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 x x 0 0 ? 0 0 1 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 1 ? 0 0 0 0 x x 0 0 0 x x 0 1 0 0 0 0 ? x 0 0 x x x 0 x x x ? 0 0 ? 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 x ? x 0 0 0 x 0 0 x 0 0 0 0 x 0 0 0 0 0 0 ? x x x x 0 0 0 ? x x ? 0 0 0 ? 0 x 0 0 0 0 0 0 0 x ? 0 0 0 0 0 0 0 0 ? 0 0 0 x 0 0 0 0 ? x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 x x 0 ? x x 0 ? 0 ? ? ? ? x 0 0 0 ? 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 ? 0 0 0 0 0 0 0 ? 0 x 0 0 1 x 0 0 0 0 0 0 x 0 0 0 0 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? x ? 0 x 0 ? 0 x 0 x 1 0 0 x 0 0 0 0 0 0 0 0 0 0 0 ? x ? ? 0 ? 0 0 ? ? 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 x 0 0 0 x x x 0 x ? 0 0 0 0 x 0 0 0 0 0 0 x 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 1 x 0 0 ? x x x 0 0 0 0 ? ? 0 x x 0 ? x x ? x 0 0 0 0 x 0 x 0 ? 0 0 0 ? x 0 ? ? x ? x x ? 0 0 0 0 0 ? 0 0 ? x 0 ? 0 0 x 0 0 0 ? 0 0 0 x 0 0 0 0 0 ? ? 0 0 1 ? 0 ? 0 ? ? 0 ? x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 x 0 0 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 ? 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 x ? 0 0 0 0 0 x 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 x x x 0 0 0 0 0 x 0 x 0 x 0 0 x x 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 x x x 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 ? 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 1 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 ? ? ? 0 0 x 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? ? ? ? 0 x 0 ? 0 0 ? ? 0 0 ? ? ? 0 x x x 0 0 x x 0 ? 0 0 0 1 ? ? 0 x 0 0 0 ? 0 0 x 0 x x 0 ? 0 0 0 0 x 0 x x x ? 0 0 0 0 0 0 x 0 0 ? 0 0 0 0 0 0 x ? ? 0 0 ? 0 0 0 0 ? x 0 0 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 1 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Gamehack.AEM

Files Modified

File Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\conerr$ Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe ᱲ狶綸ǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe 폛ر쉬ǜ RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Tl7� �v xy������!wz%:�(�1`1�1HO>3�@V�A��H[uJ��N$X�_�zi��k`k�qrnJu�~w�n{b����P��{�������b:���������6��h ���a �n��F��m�Ù�ͪ�t�������$�8წ���&M�`��o�=�S/ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 띳ǜ RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAllocateLocallyUniqueId
  • ntdll.dll!NtAllocateReserveObject
  • ntdll.dll!NtAlpcAcceptConnectPort
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreatePort
  • ntdll.dll!NtAlpcCreateSecurityContext
Show More
  • ntdll.dll!NtAlpcDeleteSecurityContext
  • ntdll.dll!NtAlpcOpenSenderProcess
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFindAtom
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenMutant
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryObject
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRemoveIoCompletionEx
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetIoCompletionEx
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTerminateProcess
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtUnsubscribeWnfStateChange
  • ntdll.dll!NtUpdateWnfStateData
  • ntdll.dll!NtWaitForAlertByThreadId

117 additional items are not displayed above.

Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation
Process Terminate
  • TerminateProcess
Process Manipulation Evasion
  • NtUnmapViewOfSection