PUP.Gamehack.GFT
The detection of PUP.Gamehack.GFT on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.
Table of Contents
What Is PUP.Gamehack.GFT?
PUP.Gamehack.GFT is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your computer's performance, security, and overall user experience. They often come bundled with other software or are downloaded from untrusted sources, and can be challenging to remove without proper guidance.
How PUP.Gamehack.GFT Operates
PUPs like PUP.Gamehack.GFT typically operate by installing themselves on your system and then modifying various settings to achieve their goals. They may alter your browser settings, install additional software, or display unwanted advertisements. In some cases, PUPs can also collect user data, such as browsing history or personal information, without consent. It's crucial to remove PUPs as soon as possible to prevent any potential harm to your system or personal data.
Symptoms of Infection
If your system is infected with PUP.Gamehack.GFT, you may experience various symptoms, including slow system performance, unwanted pop-ups or advertisements, and changes to your browser settings. You may also notice that your system is crashing or freezing frequently, or that your browser is being redirected to unfamiliar websites. In some cases, you may not notice any symptoms at all, which is why it's essential to run regular virus scans and monitor your system's performance closely.
How to Remove PUP.Gamehack.GFT
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more straightforward removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs associated with PUP.Gamehack.GFT.
- Uninstall any suspicious programs or software that may be related to the PUP. Be cautious when uninstalling programs, as some may be legitimate or required by your system.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by the PUP.
- Reboot your system and run another scan with your anti-malware tool to ensure that all remnants of the PUP have been removed.
Conclusion
Removing PUP.Gamehack.GFT from your system is crucial to prevent any potential harm to your computer's performance and security. By following the steps outlined above, you can effectively remove this PUP and restore your system to its optimal state. Remember to always be cautious when downloading software or clicking on links from untrusted sources, and to run regular virus scans to protect your system from potential threats. If you're unsure about any aspect of the removal process, consider seeking guidance from a professional or contacting a reputable anti-malware support team for assistance.
Analysis Report
General information
| Family Name: | PUP.Gamehack.GFT |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
f035adab359c87101561bbb730cfe2c2
SHA1:
e1e697d770880b3b70578f8928317e07df580d64
SHA256:
390FA14B0606B35D7BD461200D3C694C9290DB098B0922E8707DB6530F412CE1
File Size:
2.85 MB, 2854912 bytes
|
|
MD5:
f35f675a2a10b8b4158598d61279ee23
SHA1:
506b29ec74800dcb31a50f9bd6df0a2b18efc7ac
SHA256:
4B4069449006E8C9749D02D3BDBE9CF8F0FC2865A01BBE7E792F3DE7DF798395
File Size:
864.77 KB, 864768 bytes
|
|
MD5:
3289fe18ecaae9d3c6625f1babbd5eab
SHA1:
9381dbf639abba49d3354540815e6fa99e149c9d
SHA256:
750E1394A49BCD7D9E8A3879B213A1569E8AEBDAB82FE7D518017EA5863AEA3B
File Size:
2.00 MB, 1998848 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- fptable
- HighEntropy
- imgui
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,532 |
|---|---|
| Potentially Malicious Blocks: | 170 |
| Whitelisted Blocks: | 3,165 |
| Unknown Blocks: | 197 |
Visual Map
?
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
x
?
?
?
0
0
?
0
?
?
?
?
?
0
?
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
?
0
?
?
?
0
0
?
x
?
?
?
?
?
?
0
0
?
x
?
?
?
?
0
?
?
0
0
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
1
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
0
0
0
0
x
x
0
?
?
0
0
0
0
0
?
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
?
0
x
0
0
0
0
x
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
?
0
?
?
0
?
?
?
0
0
0
0
0
1
0
0
?
?
0
?
?
?
?
?
?
?
?
0
0
?
?
0
0
?
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
?
0
0
?
0
?
0
0
0
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
x
0
?
?
?
0
?
0
?
?
0
?
0
?
0
1
x
1
?
0
?
0
0
?
0
?
?
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
?
x
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
?
?
0
0
?
0
?
?
0
0
0
0
0
?
0
?
?
0
0
?
?
?
0
?
?
?
?
?
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
?
0
0
?
0
x
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
1
x
?
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
?
0
0
0
x
0
?
0
?
0
0
0
x
0
1
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
?
?
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
?
0
x
x
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
?
0
0
x
0
0
0
0
0
x
x
x
0
x
x
x
x
0
0
0
1
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
x
0
x
0
x
0
0
0
0
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
1
0
0
0
1
?
?
?
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
x
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
x
0
?
0
0
0
0
0
0
0
1
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
1
0
0
0
?
x
0
0
0
0
x
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
x
0
1
0
0
0
0
x
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
1
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
?
0
0
0
0
1
?
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
?
x
0
0
x
x
0
0
0
0
x
x
0
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
?
x
0
0
x
0
x
0
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
x
0
0
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
0
x
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
?
0
x
0
?
?
0
0
?
?
0
0
0
0
x
x
x
x
0
0
0
0
0
?
0
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 贈ߪ쥜ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �m �v����(�1�1HO @V� _�zb"hk�q{b��P� ������m� ����$�8წ�� �=�SB1_ T�Vw���%������ �AE��D��&��$���L | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Anti Debug |
|
| Process Terminate |
|
