PUP.Gamehack.GHG
The detection of PUP.Gamehack.GHG on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Gamehack.GHG?
PUP.Gamehack.GHG is a type of malware that is classified as a potentially unwanted program. This means that it may not be as malicious as other types of malware, such as viruses or Trojans, but it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and expertise.
How PUP.Gamehack.GHG Operates
PUP.Gamehack.GHG, like other PUPs, operates by installing itself on your system and then executing its payload. This can happen through various means, such as drive-by downloads, exploited vulnerabilities, or social engineering tactics. Once installed, the PUP can start to collect data, display unwanted advertisements, or even install additional malware. It's crucial to be aware of the potential risks and take steps to protect your system and personal data.
Symptoms of Infection
If your system is infected with PUP.Gamehack.GHG, you may notice various symptoms, such as slow system performance, unwanted pop-ups or advertisements, or suspicious programs running in the background. You may also experience issues with your browser, such as changed settings or unfamiliar toolbars. In some cases, the PUP may even collect your personal data, such as browsing history or login credentials, and transmit it to remote servers.
- Unwanted advertisements or pop-ups
- Suspicious programs or processes running in the background
- Changed browser settings or unfamiliar toolbars
- Slow system performance or crashes
- Data collection or transmission to remote servers
How to Remove PUP.Gamehack.GHG
- Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more effective removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious components.
- Uninstall any suspicious programs or applications that may be related to the PUP.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any unwanted changes or extensions.
- Reboot your system and perform a follow-up scan to ensure that the PUP has been completely removed.
Conclusion
Removing PUP.Gamehack.GHG from your system requires a combination of technical expertise and the right tools. By following the steps outlined above, you can help to ensure that your system is clean and secure. It's also essential to take preventative measures, such as keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading or installing new programs. By staying vigilant and taking proactive steps, you can help to protect your system and personal data from the risks associated with PUPs like PUP.Gamehack.GHG.
Analysis Report
General information
| Family Name: | PUP.Gamehack.GHG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
560cffebee96d61032ce07a0d6741982
SHA1:
fb434121fe4e7e8758bc384d4deb22f5af3544a6
SHA256:
82B1230429BA9D7D4254B43F5959C87766530DD0918E8698788BE0EF6C6BBBB6
File Size:
1.34 MB, 1337856 bytes
|
|
MD5:
3c7ace39f20b20a343373f4753ebe406
SHA1:
dabd2826eb7cafa19b8bc596f004ba7e4020c15f
SHA256:
474CAA41EE2F23DFC283CE86A9BD0A4BF0DE9F5A5F79052BF6029E46AEAA976C
File Size:
983.55 KB, 983552 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- fptable
- HighEntropy
- imgui
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4,707 |
|---|---|
| Potentially Malicious Blocks: | 215 |
| Whitelisted Blocks: | 3,544 |
| Unknown Blocks: | 948 |
Visual Map
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
x
0
x
x
x
x
x
x
x
x
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
x
x
0
?
0
?
0
0
0
0
x
0
0
0
?
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
?
?
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
x
?
x
?
0
?
0
x
?
0
?
0
0
?
?
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
?
0
0
0
0
0
x
0
x
0
0
x
0
0
1
x
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
?
0
0
0
0
x
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
?
?
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
x
x
0
?
?
x
0
0
0
0
0
0
0
x
x
x
0
?
0
?
?
?
?
0
?
x
x
x
x
x
x
?
?
?
?
?
?
?
?
?
?
0
0
0
?
x
x
x
0
0
0
x
?
?
?
?
?
0
?
0
x
x
x
0
?
0
0
0
0
x
x
x
?
0
0
0
0
0
x
0
0
0
?
0
0
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
?
0
0
?
?
?
0
0
0
0
?
?
0
0
0
x
x
x
x
x
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
0
0
?
?
0
0
x
?
0
0
?
0
?
?
?
?
?
?
0
0
?
0
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
0
0
?
?
0
0
?
?
?
0
0
0
0
0
0
0
0
0
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
0
?
0
?
0
0
0
0
?
?
0
0
0
0
0
0
?
0
?
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
?
?
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
?
?
?
0
0
?
0
?
?
0
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
?
?
0
0
0
0
x
0
0
0
0
0
0
x
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
0
0
0
?
0
0
0
0
0
0
?
0
0
?
0
?
0
0
0
0
?
?
0
0
0
0
0
0
?
0
?
?
?
?
?
?
?
0
0
0
0
x
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
0
0
?
0
0
?
?
?
0
?
?
0
?
?
0
0
0
0
x
0
0
0
0
0
0
?
0
?
0
?
?
?
0
0
0
x
0
0
0
0
0
0
0
0
0
?
0
?
?
0
0
0
0
0
?
?
?
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
0
0
0
0
0
?
?
?
?
0
0
?
0
0
?
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
?
?
0
0
0
?
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
1
0
0
?
0
?
0
?
?
0
x
0
0
0
0
?
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
?
?
0
?
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
0
?
?
0
0
0
0
0
0
0
x
0
0
0
?
?
0
?
?
0
0
?
0
?
0
0
0
0
?
0
0
0
?
0
?
?
?
0
0
0
0
0
0
0
?
0
?
0
?
?
0
0
?
0
?
?
0
?
0
x
?
?
0
0
0
0
x
0
0
0
?
0
0
x
0
?
?
x
0
0
?
?
?
x
0
0
0
?
?
?
?
?
?
?
0
0
0
0
0
0
0
?
0
x
0
x
0
0
?
?
?
?
?
?
x
0
0
?
0
0
0
0
0
0
0
0
0
x
?
?
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
x
?
?
0
0
0
0
?
?
?
0
0
0
0
?
0
?
x
?
?
?
?
?
0
0
0
0
0
0
0
?
0
?
0
?
0
?
x
x
0
?
0
0
0
0
0
0
0
?
0
0
0
0
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
0
?
0
0
?
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
?
x
0
?
?
0
x
x
x
x
0
0
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
?
0
0
0
?
?
0
0
0
0
?
?
0
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
?
?
0
?
?
?
0
0
0
0
0
?
?
0
0
0
0
0
0
?
0
?
?
?
?
0
?
?
?
?
?
0
0
?
?
?
?
?
0
0
?
0
?
?
x
0
?
0
?
x
0
0
0
0
0
0
0
x
0
?
0
?
?
0
?
0
?
0
x
0
0
0
?
0
0
?
0
?
?
?
?
0
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
x
?
?
?
?
0
0
0
?
?
0
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
x
x
0
0
x
x
x
x
0
0
?
?
0
0
0
0
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
0
0
0
0
?
?
?
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
0
?
0
?
?
?
0
?
0
?
0
0
0
?
?
?
?
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
?
?
?
?
?
?
?
?
0
0
0
x
?
0
?
?
?
?
?
?
?
?
?
x
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
?
?
?
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fb434121fe4e7e8758bc384d4deb22f5af3544a6_0001337856.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\dabd2826eb7cafa19b8bc596f004ba7e4020c15f_0000983552.,LiQMAxHB
|
